Package: requests-http-signature
requests-http-signatureis aRequestsauthentication plugin(requests.auth.AuthBasesubclass) implementing
theIETF HTTP Message Signatures draft standard.Installation$ pip install requests-http-signatureUsageimportrequestsfromrequests_http_signatureimportHTTPSignatureAuth,algorithmspreshared_key_id='squirrel'preshared_secret=b'monorail_cat'url='https://example.com/'auth=HTTPSignatureAuth(key=preshared_secret,key_id=preshared_key_id,signature_algorithm=algorithms.HMAC_SHA256)requests.get(url,auth=auth)By default, only theDateheader and the@method,@authority, and@target-uriderived component
identifiers are signed for body-less requests such as GET. TheDateheader is set if it is absent. In addition,
theAuthorizationheader is signed if it is present, and for requests with bodies (such as POST), theContent-Digestheader is set to the SHA256 of the request body using the format described in theIETF Digest Fields draftand signed.
To add other headers to the signature, pass an array of header names in thecovered_component_idskeyword argument.
See theAPI documentationfor the full list of options and
details.Verifying responsesThe class methodHTTPSignatureAuth.verify()can be used to verify responses received back from the server:classMyKeyResolver:defresolve_public_key(self,key_id):assertkey_id=='squirrel'return'monorail_cat'response=requests.get(url,auth=auth)verify_result=HTTPSignatureAuth.verify(response,signature_algorithm=algorithms.HMAC_SHA256,key_resolver=MyKeyResolver())More generally, you can reconstruct an arbitrary request using theRequests APIand pass it toverify():request=requests.Request(...)# Reconstruct the incoming request using the Requests APIprepared_request=request.prepare()# Generate a PreparedRequestHTTPSignatureAuth.verify(prepared_request,...)To verify incoming requests and sign responses in the context of an HTTP server, see theflask-http-signatureandhttp-message-signaturespackages.See what is signedIt is important to understand and follow the best practice rule of “See what is signed” when verifying HTTP message
signatures. The gist of this rule is: if your application neglects to verify that the information it trusts is
what was actually signed, the attacker can supply a valid signature but point you to malicious data that wasn’t signed
by that signature. Failure to follow this rule can lead to vulnerability against signature wrapping and substitution
attacks.In requests-http-signature, you can ensure that the information signed is what you expect to be signed by only trusting
the data returned by theverify()method:verify_result = HTTPSignatureAuth.verify(message, ...)See theAPI documentationfor full details.Asymmetric key algorithmsTo sign or verify messages with an asymmetric key algorithm, set thesignature_algorithmkeyword argument toalgorithms.ED25519,algorithms.ECDSA_P256_SHA256,algorithms.RSA_V1_5_SHA256, oralgorithms.RSA_PSS_SHA512. Note that signing with rsa-pss-sha512 is not currently supported due to a limitation of
the cryptography library.For asymmetric key algorithms, you can supply the private key as thekeyparameter to theHTTPSignatureAuth()constructor as bytes in the PEM format, or configure the key resolver as follows:withopen('key.pem','rb')asfh:auth=HTTPSignatureAuth(algorithm=algorithms.RSA_V1_5_SHA256,key=fh.read(),key_id=preshared_key_id)requests.get(url,auth=auth)classMyKeyResolver:defresolve_public_key(self,key_id:str):returnpublic_key_pem_bytes[key_id]defresolve_private_key(self,key_id:str):returnprivate_key_pem_bytes[key_id]auth=HTTPSignatureAuth(algorithm=algorithms.RSA_V1_5_SHA256,key=fh.read(),key_resolver=MyKeyResolver())requests.get(url,auth=auth)Digest algorithmsTo generate a Content-Digest header using SHA-512 instead of the default SHA-256, subclassHTTPSignatureAuthas
follows:class MySigner(HTTPSignatureAuth):
    signing_content_digest_algorithm = "sha-512"LinksProject home page (GitHub)Package documentationPackage distribution (PyPI)Change loghttp-message-signatures- a dependency of this library that
handles much of the implementationIETF HTTP Signatures draftBugsPlease report bugs, issues, feature requests, etc. onGitHub.LicenseLicensed under the terms of theApache License, Version 2.0.