def test_verify():
timestamp = 12347456
shr = SignedHttpRequest(SIGN_KEY)
result = shr.sign(alg=ALG, time_stamp=12347456, **DEFAULT_DATA)
signature = shr.verify(signature=result, **DEFAULT_DATA)
assert signature["ts"] == timestamp
def test_verify_with_too_few(param):
test_data = copy.deepcopy(DEFAULT_DATA)
test_data[param]["foo"] = "bar" # insert extra param
shr = SignedHttpRequest(SIGN_KEY)
result = shr.sign(alg=ALG, **test_data)
with pytest.raises(ValidationError):
shr.verify(signature=result, **DEFAULT_DATA)
def test_verify_fail(param, value):
shr = SignedHttpRequest(SIGN_KEY)
result = shr.sign(alg=ALG, **DEFAULT_DATA)
wrong_data = DEFAULT_DATA.copy()
wrong_data[param] = value
with pytest.raises(ValidationError):
shr.verify(signature=result, **wrong_data)
def eval_signed_http_request(self, pop_token, access_token, method, url,
headers, body=''):
kwargs = sign_http_args(method, url, headers, body)
shr = SignedHttpRequest(self.token2key[access_token][0])
return shr.verify(signature=pop_token,
strict_query_params_verification=True,
strict_headers_verification=True, **kwargs)
def test_verify_reject_jws_wo_typ_pop():
method = "GET"
signature_without_typ = JWS(json.dumps(dict(m=method)),
alg=ALG).sign_compact([SIGN_KEY])
shr = SignedHttpRequest(SIGN_KEY)
with pytest.raises(ValidationError) as exc:
shr.verify(signature_without_typ, method=method)
assert "typ" in str(exc.value)
def test_verify_not_strict(param):
shr = SignedHttpRequest(SIGN_KEY)
result = shr.sign(alg=ALG, **DEFAULT_DATA)
request_with_extra_params = copy.deepcopy(DEFAULT_DATA)
request_with_extra_params[param]["foo"] = "bar" # insert extra param
shr.verify(signature=result,
strict_query_params_verification=False,
strict_headers_verification=False,
**DEFAULT_DATA)
def test_verify_strict_with_too_many(param):
shr = SignedHttpRequest(SIGN_KEY)
result = shr.sign(alg=ALG, **DEFAULT_DATA)
request_with_extra_params = copy.deepcopy(DEFAULT_DATA)
request_with_extra_params[param]["foo"] = "bar" # insert extra param
with pytest.raises(ValidationError):
shr.verify(signature=result,
strict_query_params_verification=True,
strict_headers_verification=True,
**request_with_extra_params)
def __call__(self, method, url, **kwargs):
try:
body = kwargs["body"]
except KeyError:
body = None
try:
headers = kwargs["headers"]
except KeyError:
headers = {}
_kwargs = sign_http_args(method, url, headers, body)
shr = SignedHttpRequest(self.key)
kwargs["Authorization"] = "pop {}".format(shr.sign(alg=self.alg, **_kwargs))
return kwargs
def userinfo_endpoint(self, request, **kwargs):
access_token = self._parse_access_token(request)
shr = SignedHttpRequest(self._get_client_public_key(access_token))
http_signature = self._parse_signature(request)
try:
shr.verify(http_signature,
method=request["method"],
host=request["host"],
path=request["path"],
query_params=request["query"],
headers=request["headers"],
body=request["body"],
strict_query_param_verification=True,
strict_headers_verification=False)
except ValidationError:
return self._error_response("access_denied",
descr="Could not verify proof of "
"possession")
return self._do_user_info(self.access_tokens[access_token], **kwargs)
def test_verify_fail_wrong_key():
shr = SignedHttpRequest(SIGN_KEY)
result = shr.sign(alg=ALG, **DEFAULT_DATA)
with pytest.raises(ValidationError):
rshr = SignedHttpRequest(SYMKey(key="wrong_key", alg="HS256"))
rshr.verify(signature=result, **DEFAULT_DATA)
def test_sign_empty_http_req():
with pytest.raises(ValueError):
SignedHttpRequest(SIGN_KEY).sign(ALG)
def test_sign_specifies_jws_typ_pop():
shr = SignedHttpRequest(SIGN_KEY)
result = shr.sign(alg=ALG, body="abcdef")
assert JWT().unpack(result).headers["typ"] == "pop"
def test_verify_fail_on_missing_body():
shr = SignedHttpRequest(SIGN_KEY)
result = shr.sign(alg=ALG, body="abcdef")
with pytest.raises(ValidationError):
shr.verify(signature=result)
