Verifying responses

The class method HTTPSignatureAuth.verify() can be used to verify responses received back from the server:

class MyKeyResolver:
    def resolve_public_key(self, key_id):
        assert key_id == 'squirrel'
        return 'monorail_cat'

response = requests.get(url, auth=auth)
verify_result = HTTPSignatureAuth.verify(response,
                                         signature_algorithm=algorithms.HMAC_SHA256,
                                         key_resolver=MyKeyResolver())

More generally, you can reconstruct an arbitrary request using the Requests API and pass it to verify():

request = requests.Request(...)  # Reconstruct the incoming request using the Requests API
prepared_request = request.prepare()  # Generate a PreparedRequest
HTTPSignatureAuth.verify(prepared_request, ...)

To verify incoming requests and sign responses in the context of an HTTP server, see the flask-http-signature and http-message-signatures packages.

See the API documentation for full details.

Asymmetric key algorithms

To sign or verify messages with an asymmetric key algorithm, set the signature_algorithm keyword argument to algorithms.ED25519, algorithms.ECDSA_P256_SHA256, algorithms.RSA_V1_5_SHA256, or algorithms.RSA_PSS_SHA512. Note that signing with rsa-pss-sha512 is not currently supported due to a limitation of the cryptography library.

For asymmetric key algorithms, you can supply the private key as the key parameter to the HTTPSignatureAuth() constructor as bytes in the PEM format, or configure the key resolver as follows:

with open('key.pem', 'rb') as fh:
    auth = HTTPSignatureAuth(algorithm=algorithms.RSA_V1_5_SHA256,
                             key=fh.read(),
                             key_id=preshared_key_id)
requests.get(url, auth=auth)

class MyKeyResolver:
    def resolve_public_key(self, key_id: str):
        return public_key_pem_bytes[key_id]

    def resolve_private_key(self, key_id: str):
        return private_key_pem_bytes[key_id]

auth = HTTPSignatureAuth(algorithm=algorithms.RSA_V1_5_SHA256,
                         key=fh.read(),
                         key_resolver=MyKeyResolver())
requests.get(url, auth=auth)

Digest algorithms

To generate a Content-Digest header using SHA-512 instead of the default SHA-256, subclass HTTPSignatureAuth as follows:

class MySigner(HTTPSignatureAuth):
    signing_content_digest_algorithm = "sha-512"

Bugs

Please report bugs, issues, feature requests, etc. on GitHub.