Add note about reconstructing incoming requests

pull/34/head
Andrey Kislyuk 2022-04-11 08:44:53 -07:00
parent 40c4a1522c
commit a01c9a6128
No known key found for this signature in database
GPG Key ID: 8AFAFCD242818A52
2 changed files with 10 additions and 1 deletions

View File

@ -42,6 +42,8 @@ incoming requests:
assert key_id == 'squirrel'
return 'monorail_cat'
request = requests.Request(...) # Reconstruct the incoming request using the Requests API
request = request.prepare()
HTTPSignatureAuth.verify(request, signature_algorithm=algorithms.HMAC_SHA256, key_resolver=key_resolver)
.. admonition:: See what is signed

View File

@ -166,7 +166,14 @@ class HTTPSignatureAuth(requests.auth.AuthBase):
You can ensure that the information signed is what you expect to be signed by only trusting the *VerifyResult*
tuple returned by ``verify()``.
:param request: The HTTP request to verify.
:param request:
The HTTP request to verify. You can reconstruct an incoming request using the
`Requests API <https://docs.python-requests.org/en/latest/api/#requests.Request>`_ as follows::
request = requests.Request(...)
request = request.prepare()
HTTPSignatureAuth.verify(request, ...)
:param require_components:
A list of lowercased header names or derived component IDs ("@method", "@target-uri", "@authority",
"@scheme", "@request-target", "@path", "@query", "@query-params", "@status", or "@request-response" as