Implement BasicAuth decode classmethod. #744

luhn · 2016-01-19T16:17:00Z

If you can encode, you should be able to decode.

Loosely based off of https://github.com/rdegges/python-basicauth, which is in the public domain.

kxepal · 2016-01-19T16:24:34Z

aiohttp/helpers.py

+                raise ValueError('Unknown authorization method %s' % split[0])
+            to_decode = split[1]
+        elif len(split) == 1:
+            to_decode = split[0]


Why this case exists?

Because https://github.com/rdegges/python-basicauth implements it. Happy to remove it if you want.

I would be better strict to the specification where auth scheme is mandatory. Unlikely Authorization: Zm9vOmJhcg== will be a valid basic auth header.

asvetlov · 2016-01-19T16:43:35Z

I want have a real use case anyway.
What the purpose of added method?

luhn · 2016-01-19T16:49:38Z

So I can implement Basic Auth on my server.

auth = BasicAuth.decode(request.headers['Authorization'])
if not (auth.login == 'admin' and auth.password == 'password123'):
    raise HTTPForbidden(reason='Go away, hacker!')

asvetlov · 2016-01-19T16:53:20Z

@luhn sounds good.
Would you implement Request.authorization property also? It may be similar to .if_modified_since https://github.com/KeepSafe/aiohttp/blob/master/aiohttp/web_reqrep.py#L229

luhn · 2016-01-19T18:45:31Z

Done.

asvetlov · 2016-01-19T20:05:01Z

Almost perfect from my side but BasicAuth.decode should be documented in docs/client_reference.rst and Request.authorization in docs/web_reference.rst.
Sorry, I don't want to use autodoc feature -- docstrings should be readable and relative short.
All autodoc-styled docstrings will be replaced eventually.

@kxepal are you ok with PR's functionality?

kxepal · 2016-01-19T23:05:27Z

aiohttp/web_reqrep.py

+        header = self.headers.get(_AUTHORIZATION)
+        if header is not None:
+            try:
+                return BasicAuth.decode(header)


Here is the trick:

>>> header = 'basic aGVsbG860LzQuNGAIQ==' >>> auth = BasicAuth.decode(header) >>> auth.password 'Ð¼Ð¸Ñ\x80! '>>> bytearray([ord(i) for i in auth.password]).decode('utf-8') 'мир!'

So, unfortunately, this method will work correctly until you stay in latin1 name space. If your users will be allowed to have unicode wide password, they'll have to reimplement it. Somehow you'll have to inject encoding here. Thoughts?

We could remain encoding-neutral and have BasicAuth store login and password as bytes rather than strings.

Or we could assume UTF-8, since it is fairly universal these days. Also, the latest update on HTTP Basic Auth defines a charset field, but UTF-8 is the only allowed value (seems silly), so UTF-8 doesn't seem that bad of an assumption.

@luhn I would agree with that with happy, but you don't know how many services that works with the local national encoding by default (this includes latin1, cp1251, etc.) /:

The charset parameter you reference works only with the flow:

Make request

Receive HTTP 401 with WWW-Authenticate and that charset param

Resend request with Authorization header where credentials respects previously mentioned charset

This means some interaction with the user and works perfectly with the browsers, but not with the libraries ):

Understood.

We could make authorization a method instead of a property and have an encoding argument?

Suddenly, it seems so.

Or may be don't try to parse anything here and just return Authorization header as is. The more I'm thinking about the more I realize that to handle this header no matter for what auth scheme you need somehow interact with application config (for the encoding, secrets, hash algos etc.). The request eventually known nothing about these bits and it shouldn't. This will delegate parse task to user land where it's possible to do that correctly and without much hacks.

@asvetlov what do you think?

kxepal · 2016-01-19T23:23:08Z

@asvetlov Basically, yes, but there are few edge cases. The Request.authorization is good idea and I wonder if it's possible to make it plug-able to allow users easily manage various auth scheme handlers for oauth, api tokens and else reusing Request API instead on implementing own helpers. Feature is definitely not for this PR, but I think in basics it can help to deal with annoying encoding bit.

asvetlov · 2016-02-28T12:09:59Z

Ok. Let's implement .encode() only without .authorization.
It's really not obvious now how to process different auth schemes.
@luhn would you update the Pull Request?

This reverts commit 3eff09a.

luhn · 2016-05-03T16:10:11Z

Hi guys, sorry for the delay, forgot about this PR. Is this what you wanted?

fafhrd91 · 2016-05-23T18:18:01Z

@asvetlov @kxepal status?

kxepal · 2016-05-23T18:45:16Z

aiohttp/helpers.py

+        header.
+
+        :param auth_header:  The value of the ``Authorization`` header.
+        :type auth_header:  str


You can use :param str auth_header: ... today, but aiohttp doesn't uses docstring in code, but separate files under doc/ directory.

kxepal · 2016-05-23T18:46:01Z

LGFM except docs bit.

luhn · 2016-05-23T19:08:19Z

How's that?

coveralls · 2016-05-23T19:13:37Z

Coverage decreased (-0.02%) to 98.196% when pulling 1f14c40 on luhn:basic-auth-decode into 024f6e1 on KeepSafe:master.

kxepal · 2016-05-23T19:41:04Z

@luhn here: https://github.com/KeepSafe/aiohttp/blob/master/docs/client_reference.rst#basicauth

luhn · 2016-05-23T19:53:39Z

I don't understand what it is you wish me to do.

luhn · 2016-05-23T20:54:17Z

To clarify: I've already updated the docs in client_reference.rst and I'm unsure what further needs to be done.

kxepal · 2016-05-23T20:56:13Z

@luhn mmm...it seems I was look on some old commit then. Sorry for confusion, everything looks good for me. +1

fafhrd91 · 2016-05-23T20:56:53Z

Thanks!

lock · 2019-10-29T18:05:13Z

This thread has been automatically locked since there has not been
any recent activity after it was closed. Please open a new issue for
related bugs.

If you feel like there's important points made in this discussion,
please include those exceprts into that new issue.

Implement BasicAuth decode classmethod.

337346e

kxepal reviewed Jan 19, 2016
View reviewed changes

luhn force-pushed the basic-auth-decode branch from 337346e to 27a5feb Compare January 19, 2016 16:30

Flake8 fixes.

ef0e9f7

luhn force-pushed the basic-auth-decode branch from 27a5feb to ef0e9f7 Compare January 19, 2016 16:30

Pass through encoding in BasicAuth.decode

ef37fa9

luhn added 3 commits January 19, 2016 10:33

Don't be so forgiving when parsing basic auth.

9e8bd58

Merge remote-tracking branch 'upstream/master' into basic-auth-decode

7617ffa

Implement Request.authorization

3eff09a

kxepal reviewed Jan 19, 2016
View reviewed changes

luhn added 2 commits May 3, 2016 09:06

Revert "Implement Request.authorization"

06b5f0e

This reverts commit 3eff09a.

Merge remote-tracking branch 'upstream/master' into basic-auth-decode

12fe2c2

Document.

c351ca7

kxepal reviewed May 23, 2016
View reviewed changes

Remove docstring.

1f14c40

luhn added 2 commits May 23, 2016 12:22

Merge remote-tracking branch 'upstream/master' into basic-auth-decode

d398708

Add additional test to increase coverage.

46db268

fafhrd91 merged commit bc165f1 into aio-libs:master May 23, 2016

lock bot added the outdated label Oct 29, 2019

lock bot locked as resolved and limited conversation to collaborators Oct 29, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Implement BasicAuth decode classmethod. #744

Implement BasicAuth decode classmethod. #744

luhn commented Jan 19, 2016

kxepal Jan 19, 2016

luhn Jan 19, 2016

kxepal Jan 19, 2016

asvetlov commented Jan 19, 2016

luhn commented Jan 19, 2016

asvetlov commented Jan 19, 2016

luhn commented Jan 19, 2016

asvetlov commented Jan 19, 2016

kxepal Jan 19, 2016

luhn Jan 19, 2016

kxepal Jan 19, 2016

luhn Jan 19, 2016

kxepal Jan 19, 2016

kxepal commented Jan 19, 2016

asvetlov commented Feb 28, 2016

luhn commented May 3, 2016

fafhrd91 commented May 23, 2016

kxepal May 23, 2016 •

edited

Loading

kxepal commented May 23, 2016

luhn commented May 23, 2016

coveralls commented May 23, 2016 •

edited

Loading

kxepal commented May 23, 2016

luhn commented May 23, 2016

luhn commented May 23, 2016

kxepal commented May 23, 2016

fafhrd91 commented May 23, 2016

lock bot commented Oct 29, 2019

Implement BasicAuth decode classmethod. #744

Implement BasicAuth decode classmethod. #744

Conversation

luhn commented Jan 19, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

asvetlov commented Jan 19, 2016

luhn commented Jan 19, 2016

asvetlov commented Jan 19, 2016

luhn commented Jan 19, 2016

asvetlov commented Jan 19, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kxepal commented Jan 19, 2016

asvetlov commented Feb 28, 2016

luhn commented May 3, 2016

fafhrd91 commented May 23, 2016

kxepal May 23, 2016 • edited Loading

Choose a reason for hiding this comment

kxepal commented May 23, 2016

luhn commented May 23, 2016

coveralls commented May 23, 2016 • edited Loading

kxepal commented May 23, 2016

luhn commented May 23, 2016

luhn commented May 23, 2016

kxepal commented May 23, 2016

fafhrd91 commented May 23, 2016

lock bot commented Oct 29, 2019

kxepal May 23, 2016 •

edited

Loading

coveralls commented May 23, 2016 •

edited

Loading