Package: asgi-signing-middleware
ASGI Signing MiddlewareThe goal of this project is to provide a simple and straightforward way to securely sign data by providing ready-to-use middlewares, usingblake2signeras signing backend.Why would I need to use it?If you need to store some data (state, generally), and want to avoid using a trusted DB for performance reasons, it is usually advisable to sign said data. This package will help you achieve that with ease, ready-to-use middlewares, without you needing to think on the details: just provide a signing secret and let this package handle the rest.Why would I want to use it?Because it is a relativelysmall(around 100 logical lines of code),simple(usage is very straight-forward) yet verycustomizableandfastmiddleware data signer. My idea is to keep it as uncomplicated as possible without much room to become afootgun. Alldefaults are very sane(secure) and everythingjust worksout of the box.GoalsBe safe and secure.Be simple and straightforward.Followsemver.Be always typed.100% coverage.Secondary goalsIf possible, maintain active Python versions (3.8+).InstallingThis package is hosted onPyPiso just:python3 -m pip install asgi-signing-middlewarepoetry add asgi-signing-middlewarepipenv install asgi-signing-middlewareYou can check thereleases' pagefor package hashes and signatures.RequirementsPython 3.8+blake2signerstarletteor FastAPIor StarliteVersions currently tested (check thepipelines):CPython 3.8CPython 3.9CPython 3.10CPython 3.11PyPy3.8Stackless3.8Tl; Dr Example"""Tl;dr example."""importtypingfromfastapiimportFastAPIfromfastapiimportRequestfromasgi_signing_middlewareimportSerializedSignedCookieMiddlewareapp=FastAPI()app.add_middleware(SerializedSignedCookieMiddleware,# Any of the middlewares# Follows the middleware parameterssecret=b'a very, very secret thing',# This should probably come from some configsstate_attribute_name='messages',# Use in a request handler as `request.state.messages`cookie_name='my_cookie',cookie_ttl=60*5,# 5 minutes, in seconds# You can also set extra signer kwargs and cookie properties, check the middleware# init for more info.)@app.get('/cookie')defcookie_endpoint(request:Request)->None:# This will only have data that was correctly signed, or Nonecookie_data:typing.Optional[typing.Dict[str,str]]=request.state.messages# ...# This will be signed and written into the cookierequest.state.messages={'A Title':'The message','Another title':'With another msg'}Tip: all modules, classes, methods and functions are documented so don't doubt asking forhelp().DocumentationCheck out thisproject docs onlineor locally withinv docs. Alternatively, build them locally usinginv docs --build.NoticeI'm not a cryptoexpert, sothis project needs a security review. If you are one and can do it, pleasecontact me.LicenseASGI Signing Middlewareis made byHacKanunder MPL v2.0. You are free to use, share, modify and share modifications under the terms of thatlicense.  Derived works may link back to the canonical repository:https://gitlab.com/hackancuba/asgi-signing-middleware.Copyright (C) 2022 HacKan (https://hackan.net)
This Source Code Form is subject to the terms of the Mozilla Public
License, v. 2.0. If a copy of the MPL was not distributed with this
file, You can obtain one at https://mozilla.org/MPL/2.0/.