phillipmartin / flask-hmacauth Goto Github PK

Hi,

Thanks for the library. I think this line

signature=hmac.new(api_key, msg=query).hexdigest()

in the client example should be instead

signature=hmac.new(api_key, msg=query,digestmod=hashlib.sha1).hexdigest()

since by default the digestmod of hmac is not sha1.

Thanks!
Marco

Hello,
How can i use or operator in condition hmac_auth(['role1','role2']) or something like that?
I want to have an ability to check if user included in one of this roles.
is it possible?
Thank you.

The client code should be like this (because the default digestmod of hmac.new is hashlib.md5):

import requests
import time
import hashlib

path_and_query = "/api/v1/create?TIMESTAMP="+str(int(time.time()))+"&ACCOUNT_ID=admin&foo=bar"
host = "https://example.com"
sig=hmac.new(";hi^897t7utf", digestmod=hashlib.sha1, msg=path_and_query).hexdigest()
req = requests.get(host+path_and_query, headers={'X-Auth-Signature': sig})

Under my testing, 'request' object do not have 'body' attribute in Flask 0.10, so, please consider the following patch, thanks~

--- a/flask_hmacauth.py
+++ b/flask_hmacauth.py
@@ -92,11 +92,16 @@ class HmacManager(object):

         #hash the request URL and Body
         hasher = hmac.new(secret, digestmod=self._digest)
-        #TODO: do we need encode() here?
-        url = urlparse.urlparse(request.url.encode())
+        charset = request.charset or 'utf-8'
+        url = urlparse.urlparse(request.url.encode(charset)) # For URL Query parameter
         hasher.update(url.path + "?" + url.query)
         if request.method == "POST":
-            hasher.update(request.body)
+            body = ''
+            if request.form: # For Form input
+                body = '&'.join(('='.join((key, value.encode(charset))) for key, value in request.form.items()))
+            if request.data: # For data type application/json
+                body = request.data
+            hasher.update(body)
         calculated_hash = hasher.hexdigest()

         try: