Package: djangorestframework-httpsignature
OverviewProvidesHTTP Signaturesupport forDjango REST framework. The HTTP Signature package provides a way to achieve origin authentication and message integrity for HTTP messages. Similar to Amazon’sHTTP Signature scheme, used by many of its services. TheHTTP Signaturespecification is currently an IETF draft.ContentsOverviewInstallationRunning the testsUsageRoadmapExample usage & session w/cURLInstallationInstalling the package via the repository:pip install djangorestframework-httpsignatureOlder version ofpipdon’t support the Wheel format (which is howhttpsigis distributed). The problem manifests when installing the requirements,pipwill complain that it cannot find ahttpsig. In such cases,pipneeds to be upgraded:pip install --upgrade pipAnother possible problem: while installing viapython setup.py installyou may encounter:No local packages or download links found for httpsig
error: Could not find suitable distribution for Requirement.parse('httpsig')If that is the case, usepip install httpsigto install thehttpsigpackage and retrypython setup.py install.Running the testsTo run the tests for the packages, use the following command on the repository root directory:python manage.py testUsageTo authenticate HTTP requests via HTTP signature, you need to:Install this package in your Django project, as instructed inInstallation.Addrest_framework_httpsignatureto yoursettings.pyINSTALLED_APPS.In your app code, extend theSignatureAuthenticationclass, as follows:# my_api/auth.py

from rest_framework_httpsignature.authentication import SignatureAuthentication

class MyAPISignatureAuthentication(SignatureAuthentication):
    # The HTTP header used to pass the consumer key ID.
    # Defaults to 'X-Api-Key'.
    API_KEY_HEADER = 'X-Api-Key'

    # A method to fetch (User instance, user_secret_string) from the
    # consumer key ID, or None in case it is not found.
    def fetch_user_data(self, api_key):
        # ...
        # example implementation:
        try:
            user = User.objects.get(api_key=api_key)
            return (user, user.secret)
        except User.DoesNotExist:
            return NoneConfigure Django REST framework to use you authentication class; e.g.:# my_project/settings.py

# ...
REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': (
       'my_api.auth.MyAPISignatureAuthentication',
    ),
    'DEFAULT_PERMISSION_CLASSES': (
        'rest_framework.permissions.IsAuthenticated',
    )
}
# The above will force HTTP signature for all requests.
# ...RoadmapCurrently, the library only support HMAC SHA256 for signing.TheREQUIREMENTS.txtfile is fairly strict. It is very possible that previous versions of Django and Django REST framework are supported.Since HTTP Signature uses a HTTP header for the request date and time, the authentication class could deal with request expiry.Example usage & session w/cURLAssuming the setup detailed inUsage, a project running onlocalhost:8000could be probed with cURL as follows:~$ SSS=Base64(Hmac(SECRET, "Date: Mon, 17 Feb 2014 06:11:05 GMT", SHA256))
~$ curl -v -H 'Date: "Mon, 17 Feb 2014 06:11:05 GMT"' -H 'Authorization: Signature keyId="my-key",algorithm="hmac-sha256",headers="date",signature="SSS"'And for a much less painful example, check out thehttpsig packagedocumentation to userequestsandhttpsig.