Python http-signature
Sign http requests with secure signatures.
Requirements
PyCrypto
Optional:
ssh or paramiko >= 1.8.0 (for ssh-agent integration)
requests
Usage
for simple raw signing:
import http_signature
sig_maker = http_signature.Signer(secret='test.pem', algorithm='rsa-sha256')
sig_maker.sign('hello world!')
for use with requests:
import json
import requests
from http_signature.requests_auth import HTTPSignatureAuth
auth = HTTPSignatureAuth(key_id='Test', secret='test.pem')
z = requests.get('https://api.joyentcloud.com/my/packages/Small+1GB',
auth=auth, headers={'X-Api-Version': '~6.5'})
Class initialization parameters
http_signature.Signer(secret='', algorithm='rsa-sha256', allow_agent=False)
secret, in the case of an rsa signature, is a path to a private RSA pem file. In the case of an hmac, it is a secret password. algorithm is one of the six allowed signatures: rsa-sha1, rsa-sha256, rsa-sha512, hmac-sha1, hmac-sha256, hmac-sha512. allow_agent uses the ssh package to find an ssh-agent instance running, and uses that to sign all requests. Note that if so, this overrides manual selection of the signing algorithm to rsa-sha1.
http_signature.requests_auth.HTTPSignatureAuth(key_id='', secret='', algorithm='rsa-sha256', headers=None, allow_agent=False)
key_id is the label by which the server system knows your RSA signature or password. headers is the list of HTTP headers that are concatenated and used as signing objects. By default it is the specification’s minimum, the Date HTTP header. secret, algorithm, and allow_agent are as above.
License
MIT
Changes
0.1.4 (2012-10-03)
Account for ssh now being re-merged into paramiko: either package is acceptable (but paramiko should ideally be >= 1.8.0)
0.1.3 (2012-10-02)
Stop enabling allow_agent by default
Stop requiring ssh package by default – it is imported only when allow_agent=True
Changed logic around ssh-agent: if one key is available, don’t bother with any other authentication method
Changed logic around key file usage: if decryption fails, prompt for password
Bug fix: ssh-agent resulted in a nonsensical error if it found no correct keys (thanks, petervolpe)
Introduce versioneer.py
1 maintainer
Metadata
1 maintainer
Release files for http_signature 0.1.4
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| http_signature-0.1.4.tar.gz | 9.8 kB | Without provenance | Details |
Release files / http_signature-0.1.4.tar.gz
| Download URL | http_signature-0.1.4.tar.gz |
|---|---|
| Size | 9.8 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
14acc192ef20459d5e11b4e800dd3a4542f6bd2ab191bf5717c696bf30936c62
|
|
BLAKE2b-256 checksum How to use checksums |
a051ebab9707f1e133585fd230d5a20f1e7025de284b3f387e51a29d39c9b444
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
Security for http_signature 0.1.4
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
