diff --git a/README.rst b/README.rst index e22807a..c1e96a1 100644 --- a/README.rst +++ b/README.rst @@ -42,6 +42,8 @@ incoming requests: assert key_id == 'squirrel' return 'monorail_cat' + request = requests.Request(...) # Reconstruct the incoming request using the Requests API + request = request.prepare() HTTPSignatureAuth.verify(request, signature_algorithm=algorithms.HMAC_SHA256, key_resolver=key_resolver) .. admonition:: See what is signed diff --git a/requests_http_signature/__init__.py b/requests_http_signature/__init__.py index 8e8afb0..9f04937 100644 --- a/requests_http_signature/__init__.py +++ b/requests_http_signature/__init__.py @@ -166,7 +166,14 @@ class HTTPSignatureAuth(requests.auth.AuthBase): You can ensure that the information signed is what you expect to be signed by only trusting the *VerifyResult* tuple returned by ``verify()``. - :param request: The HTTP request to verify. + :param request: + The HTTP request to verify. You can reconstruct an incoming request using the + `Requests API `_ as follows:: + + request = requests.Request(...) + request = request.prepare() + HTTPSignatureAuth.verify(request, ...) + :param require_components: A list of lowercased header names or derived component IDs ("@method", "@target-uri", "@authority", "@scheme", "@request-target", "@path", "@query", "@query-params", "@status", or "@request-response" as