Skip to main content

Cryptographically signed query parameters for pyramid

Project description

Latest Version Supported Python versions License build status

Description

This package provides a method for pyramid applications to sign parameters which are passed in query strings (or POST bodies).

The initial motivation for this was to be able to pass a return_url to a views without turning the app into open redirector.

Other use cases include being able to generate URLs (e.g. to be included in emails) which can be used to bypass the normal authentication/authorization mechanisms.

Installation

Pyramid-signed-params can be installed from PyPI using pip or easy_install (or buildout.) You should probably be installing it in a virtual environment.

Configuration

You must configure at least one signing secret in your app settings. The secret should be a random, unguessable string. E.g. in your app’s .ini file:

pyramid_signed_params.secret = RGWO7nZ6W6AiPIUcXQN2iahJIThwH9BbpyZ7Lc1XfaOkPGt1GY

Activate the package by including it in your pyramid application.

config.include('pyramid-signed-params')

This will add two new attributes to pyramid’s request.

  • request.sign_query(query, max_age=None, kid=None)

    Used to sign query arguments, e.g.

    # Pass the current URL as a signed *return_url* parameter to another view
    query = {'return_url': request.url}
    other_url = request.route_url('other', _query=request.sign_query(query))

    The max_age parameter can be used to generate signatures which expire after a certain amount of time.

    Passing kid="csrf" will create signatures which will be invalidated whenever the session’s CSRF token is changed.

  • request.signed_params

    This reified property will contain a multidict populated with all parameters passed to the request which were signed with a valid signature.

Basic Usage Example

Construct a URL which could be e-mailed out to allow changing the password of a given user:

# Construct a URL with some signed parameters
params = {'userid': 'fred', 'action': 'change-pw'}
signed_params = request.sign_query(params, max_age=3600)
url = request.route_url('change-pw', _query=signed_params)

Then, in the change-pw view:

if request.signed_params['action'] != 'change-pw':
    raise HTTPForbidden()
userid = request.signed_params['userid']

# Do whatever needs to be done to change the given users password

Note that because we passed max_age=3600 to sign_query, the URL will only work for an hour.

Caution

This package provides no inherent protection against replay attacks. If an attacker has access to a set of signed parameters, he may pass those signed parameters, unmodified, to any URL within the app (or other apps sharing the same signing secret.)

Authors

Jeff Dairiki

Changes

Release 0.1b4 (2017-12-18)

Packaging

  • Drop CPython 3.3 classifier

Release 0.1b3 (2017-12-18)

Compatibility

  • Drop support for python 3.3.

Packaging

  • Include LICENSE.txt and pytest.ini in sdist.

Release 0.1b2 (2017-11-16)

  • Change the signed_params reified request method so that it catches UnicodeDecodeErrors when accessing request.params, and returns an empty dict. (If the parameters are not properly encoded, there are no valid signed parameters.)

Release 0.1b1 (2017-11-16)

  • Drop support for python 2.6. Test under python 3.6.

Security

  • Explicitly specify allowed algorithms when decoding JWTs.

Release 0.1a5 (2016-11-13)

  • Remove the (broken) config-time warning issued if no service is registered for ISignedParamsService. (When autocommit was off, this warning was always being issued.)

Release 0.1a4 (2016-11-02)

  • The setting for configuring the JWT signing secret(s) has been renamed to pyramid_signed_param.secret from pyramid_signed_param.secrets. Basic usage involve only a single secret. (Two allow for rotation of secrets, any configured secrets are accepted when verifying signatures, but only the first is used for creating new signatures.)

  • Pyramid_signed_params.include now issues a warning if the ISignedParamsService is not configured.

  • JWTSecretProviderFactory now raises a ConfigurationError if no secrets are found in the app settings.

Release 0.1a3 (2016-11-02)

Initial release.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

pyramid-signed-params-0.1b4.tar.gz (11.5 kB view hashes)

Uploaded Source

Built Distribution

pyramid_signed_params-0.1b4-py2.py3-none-any.whl (15.6 kB view hashes)

Uploaded Python 2 Python 3

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page