idangazit/oauthlib — pull request #37 by ib-lundgren (2012-05-14 11:10:00+00:00)
Title: Securing server

Been brewing quite a big batch of updates to Server...

Server is now adhering very strictly to the spec.

- parameters are only supplied in one source which may be the URI query, the Authorization header or the body and there may not be duplicated params

- all parameters are validated, i.e. client key in database. *just noticed redir uri validation is missing, will add commit later this week.*

- the supplied signature is verified, either against a recalculated one or using public key verification

In addition a number of good security practices where added:

- per request ability to require resource owner, realm and verifier params

- default enforcement of HTTPS, configurable using property

- very strict whitelisting checks of all input parameters ensuring they only contain safe characters and are of a certain length, checks can be overloaded in inheriting classes or configured using properties. Used to prevent SQL & OS Command injection, file traversal attacks etc.

- timing attacks are mitigated using near constant time request verification, achieved using dummy values and constant time string comparison (see common.safe_compare)

Note that I also added 3 new verification methods to signature.py and modified the sign_rsa_sha1 to use PyCrypto again. Changed to PyCrypto since python-rsa could not even load a properly formatted public key.