httpsig 1.3.0

Requirements

• Python 2.7, 3.4-3.7

• PyCryptodome

Optional:

• requests

For testing:

• tox

• pyenv (optional, handy way to access multiple versions)

  $ for VERS in 2.7.15 3.4.9 3.5.6 3.6.7 3.7.1; do pyenv install -s $VERS; done

Usage

Real documentation is forthcoming, but for now this should get you started.

For simple raw signing:

import httpsig

secret = open('rsa_private.pem', 'rb').read()

sig_maker = httpsig.Signer(secret=secret, algorithm='rsa-sha256')
sig_maker.sign('hello world!')

For general use with web frameworks:

import httpsig

key_id = "Some Key ID"
secret = b'some big secret'

hs = httpsig.HeaderSigner(key_id, secret, algorithm="hmac-sha256", headers=['(request-target)', 'host', 'date'])
signed_headers_dict = hs.sign({"Date": "Tue, 01 Jan 2014 01:01:01 GMT", "Host": "example.com"}, method="GET", path="/api/1/object/1")

For use with requests:

import json
import requests
from httpsig.requests_auth import HTTPSignatureAuth

secret = open('rsa_private.pem', 'rb').read()

auth = HTTPSignatureAuth(key_id='Test', secret=secret)
z = requests.get('https://api.example.com/path/to/endpoint',
                         auth=auth, headers={'X-Api-Version': '~6.5'})

httpsig.Signer(secret, algorithm='rsa-sha256')

httpsig.requests_auth.HTTPSignatureAuth(key_id, secret, algorithm='rsa-sha256', headers=None)

Tests

To run tests:

python setup.py test

or:

tox

Known Limitations

1. Multiple values for the same header are not supported. New headers with the same name will overwrite the previous header. It might be possible to replace the CaseInsensitiveDict with the collection that the email package uses for headers to overcome this limitation.

2. Keyfiles with passwords are not supported. There has been zero vocal demand for this so if you would like it, a PR would be a good way to get it in.

3. Draft 2 added support for ecdsa-sha256. This is available in PyCryptodome but has not been added to httpsig. PRs welcome.

License

Both this module and the original module are licensed under the MIT license.

httpsig Changes

1.3.0 (2019-Nov-28)

• Relax pycryptodome requirements (PR#14 by cveilleux)

• Ability to supply another signature header like Signature (PR#15 by rbignon)

• Fixed #2; made Signer.sign() public

• Dropped Python 3.3, added Python 3.7.

1.2.0 (2018-Mar-28)

• Switched to pycryptodome instead of PyCrypto (PR#11 by iandouglas)

• Updated tests with the test data from Draft 8 and verified it still passes.

• Dropped official Python 3.2 support (pip dropped it so it can’t be properly tested)

• Cleaned up the code to be more PEP8-like.

1.1.2 (2015-Feb-11)

• HMAC verification is now constant-time.

1.1.1 (2015-Feb-11)

• (pulled)

1.1.0 (2014-Jul-24)

• Changed “(request-line)” to “(request-target)” to comply with Draft 3.

1.0.3 (2014-Jul-09)

• Unified the default signing algo under one setting. Setting httpsig.sign.DEFAULT_SIGN_ALGORITHM changes it for all future instances.

• Handle invalid params a little better.

1.0.2 (2014-Jul-02)

• Ensure we treat headers as ASCII strings.

• Handle a case in the authorization header where there’s garbage (non-keypairs) after the method name.

http-signature (previous)