{"id":13813601,"url":"https://github.com/pyauth/requests-http-signature","last_synced_at":"2026-01-17T08:41:31.201Z","repository":{"id":40524357,"uuid":"101002050","full_name":"pyauth/requests-http-signature","owner":"pyauth","description":"A Requests auth module for the IETF HTTP Message Signatures draft standard","archived":false,"fork":false,"pushed_at":"2024-05-27T14:23:25.000Z","size":2725,"stargazers_count":74,"open_issues_count":3,"forks_count":23,"subscribers_count":5,"default_branch":"develop","last_synced_at":"2025-06-28T04:02:12.004Z","etag":null,"topics":["authentication","hmac","http","http-message-signatures","http-signature","python","python-requests"],"latest_commit_sha":null,"homepage":"https://pyauth.github.io/requests-http-signature/","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/pyauth.png","metadata":{"files":{"readme":"README.rst","changelog":"Changes.rst","contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null},"funding":{"github":["kislyuk"]}},"created_at":"2017-08-21T23:59:07.000Z","updated_at":"2024-11-06T17:58:27.000Z","dependencies_parsed_at":"2024-06-18T20:05:44.110Z","dependency_job_id":"c7ae1e8c-b5ba-41e7-bf5c-105c64bddf69","html_url":"https://github.com/pyauth/requests-http-signature","commit_stats":{"total_commits":95,"total_committers":9,"mean_commits":"10.555555555555555","dds":"0.11578947368421055","last_synced_commit":"aff77a5db3c8a0f138117523b086530b0085b949"},"previous_names":["kislyuk/requests-http-signature"],"tags_count":11,"template":false,"template_full_name":null,"purl":"pkg:github/pyauth/requests-http-signature","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pyauth%2Frequests-http-signature","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pyauth%2Frequests-http-signature/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pyauth%2Frequests-http-signature/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pyauth%2Frequests-http-signature/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/pyauth","download_url":"https://codeload.github.com/pyauth/requests-http-signature/tar.gz/refs/heads/develop","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pyauth%2Frequests-http-signature/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28504370,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-17T06:57:29.758Z","status":"ssl_error","status_checked_at":"2026-01-17T06:56:03.931Z","response_time":85,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["authentication","hmac","http","http-message-signatures","http-signature","python","python-requests"],"created_at":"2024-08-04T04:01:22.716Z","updated_at":"2026-01-17T08:41:31.184Z","avatar_url":"https://github.com/pyauth.png","language":"Python","funding_links":["https://github.com/sponsors/kislyuk"],"categories":["Python"],"sub_categories":[],"readme":"requests-http-signature: A Requests auth module for HTTP Signature\n==================================================================\n**requests-http-signature** is a `Requests \u003chttps://github.com/requests/requests\u003e`_ `authentication plugin\n\u003chttp://docs.python-requests.org/en/master/user/authentication/\u003e`_ (``requests.auth.AuthBase`` subclass) implementing\nthe\n`IETF RFC 9421 HTTP Message Signatures standard \u003chttps://datatracker.ietf.org/doc/rfc9421/\u003e`_.\n\nInstallation\n------------\n::\n\n    $ pip install requests-http-signature\n\nUsage\n-----\n\n.. code-block:: python\n\n  import requests\n  from requests_http_signature import HTTPSignatureAuth, algorithms\n  \n  preshared_key_id = 'squirrel'\n  preshared_secret = b'monorail_cat'\n  url = 'https://example.com/'\n\n  auth = HTTPSignatureAuth(key=preshared_secret,\n                           key_id=preshared_key_id,\n                           signature_algorithm=algorithms.HMAC_SHA256)\n  requests.get(url, auth=auth)\n\nBy default, only the ``Date`` header and the ``@method``, ``@authority``, and ``@target-uri`` derived component\nidentifiers are signed for body-less requests such as GET. The ``Date`` header is set if it is absent. In addition,\nthe ``Authorization`` header is signed if it is present, and for requests with bodies (such as POST), the\n``Content-Digest`` header is set to the SHA256 of the request body using the format described in the\n`IETF Digest Fields draft \u003chttps://datatracker.ietf.org/doc/html/draft-ietf-httpbis-digest-headers\u003e`_ and signed.\nTo add other headers to the signature, pass an array of header names in the ``covered_component_ids`` keyword argument.\nSee the `API documentation \u003chttps://pyauth.github.io/requests-http-signature/#id3\u003e`_ for the full list of options and\ndetails.\n\nVerifying responses\n~~~~~~~~~~~~~~~~~~~\nThe class method ``HTTPSignatureAuth.verify()`` can be used to verify responses received back from the server:\n\n.. code-block:: python\n\n  class MyKeyResolver:\n      def resolve_public_key(self, key_id):\n          assert key_id == 'squirrel'\n          return 'monorail_cat'\n\n  response = requests.get(url, auth=auth)\n  verify_result = HTTPSignatureAuth.verify(response,\n                                           signature_algorithm=algorithms.HMAC_SHA256,\n                                           key_resolver=MyKeyResolver())\n\nMore generally, you can reconstruct an arbitrary request using the\n`Requests API \u003chttps://docs.python-requests.org/en/latest/api/#requests.Request\u003e`_ and pass it to ``verify()``:\n\n.. code-block:: python\n\n  request = requests.Request(...)  # Reconstruct the incoming request using the Requests API\n  prepared_request = request.prepare()  # Generate a PreparedRequest\n  HTTPSignatureAuth.verify(prepared_request, ...)\n\nTo verify incoming requests and sign responses in the context of an HTTP server, see the\n`flask-http-signature \u003chttps://github.com/pyauth/flask-http-signature\u003e`_ and\n`http-message-signatures \u003chttps://github.com/pyauth/http-message-signatures\u003e`_ packages.\n\n.. admonition:: See what is signed\n\n It is important to understand and follow the best practice rule of \"See what is signed\" when verifying HTTP message\n signatures. The gist of this rule is: if your application neglects to verify that the information it trusts is\n what was actually signed, the attacker can supply a valid signature but point you to malicious data that wasn't signed\n by that signature. Failure to follow this rule can lead to vulnerability against signature wrapping and substitution\n attacks.\n\n In requests-http-signature, you can ensure that the information signed is what you expect to be signed by only trusting\n the data returned by the ``verify()`` method::\n\n   verify_result = HTTPSignatureAuth.verify(message, ...)\n\nSee the `API documentation \u003chttps://pyauth.github.io/requests-http-signature/#id3\u003e`_ for full details.\n\nAsymmetric key algorithms\n~~~~~~~~~~~~~~~~~~~~~~~~~\nTo sign or verify messages with an asymmetric key algorithm, set the ``signature_algorithm`` keyword argument to\n``algorithms.ED25519``, ``algorithms.ECDSA_P256_SHA256``, ``algorithms.RSA_V1_5_SHA256``, or\n``algorithms.RSA_PSS_SHA512``.\n\nFor asymmetric key algorithms, you can supply the private key as the ``key`` parameter to the ``HTTPSignatureAuth()``\nconstructor as bytes in the PEM format, or configure the key resolver as follows:\n\n.. code-block:: python\n\n  with open('key.pem', 'rb') as fh:\n      auth = HTTPSignatureAuth(signature_algorithm=algorithms.RSA_V1_5_SHA256,\n                               key=fh.read(),\n                               key_id=preshared_key_id)\n  requests.get(url, auth=auth)\n\n  class MyKeyResolver:\n      def resolve_public_key(self, key_id: str):\n          return public_key_pem_bytes[key_id]\n\n      def resolve_private_key(self, key_id: str):\n          return private_key_pem_bytes[key_id]\n\n  auth = HTTPSignatureAuth(signature_algorithm=algorithms.RSA_V1_5_SHA256,\n                           key_resolver=MyKeyResolver(),\n                           key_id=\"my-key-id\")\n  requests.get(url, auth=auth)\n\nDigest algorithms\n~~~~~~~~~~~~~~~~~\nTo generate a Content-Digest header using SHA-512 instead of the default SHA-256, subclass ``HTTPSignatureAuth`` as\nfollows::\n\n  class MySigner(HTTPSignatureAuth):\n      signing_content_digest_algorithm = \"sha-512\"\n\nAuthors\n-------\n* `Andrey Kislyuk \u003chttps://kislyuk.com\u003e`\n\nLinks\n-----\n* `Project home page (GitHub) \u003chttps://github.com/pyauth/requests-http-signature\u003e`_\n* `Package documentation \u003chttps://pyauth.github.io/requests-http-signature/\u003e`_\n* `Package distribution (PyPI) \u003chttps://pypi.python.org/pypi/requests-http-signature\u003e`_\n* `Change log \u003chttps://github.com/pyauth/requests-http-signature/blob/master/Changes.rst\u003e`_\n* `http-message-signatures \u003chttps://github.com/pyauth/http-message-signatures\u003e`_ - a dependency of this library that\n  handles much of the implementation\n* `IETF RFC 9421, HTTP Message Signatures \u003chttps://datatracker.ietf.org/doc/rfc9421/\u003e`_\n\nBugs\n~~~~\nPlease report bugs, issues, feature requests, etc. on `GitHub \u003chttps://github.com/pyauth/requests-http-signature/issues\u003e`_.\n\nLicense\n-------\nCopyright 2017-2024, Andrey Kislyuk and requests-http-signature contributors. Licensed under the terms of the\n`Apache License, Version 2.0 \u003chttp://www.apache.org/licenses/LICENSE-2.0\u003e`_. Distribution of attribution information,\nLICENSE and NOTICE files with source copies of this package and derivative works is **REQUIRED** as specified by the\nApache License.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpyauth%2Frequests-http-signature","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpyauth%2Frequests-http-signature","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpyauth%2Frequests-http-signature/lists"}