thisissoon / djangohmac Goto Github PK

Middleware protects all whole except django admin. I would be nice to have a hmac decorators based on django auth decorators.

@hmac.auth(only=["foo"])
def view(..):
   ...

PR should have tests with Django rest framework because it uses different permission approach.

sign.py calls get_signature(request) and passes it to validate_multiple_signatures(), which calls make_hmac_for(key, body). Unfortunately, the signature from get_signature is a string, whilst the signature from make_hmac_for() is a byte array.

The workaround is to cast them both to byte arrays with six.b() right before the comparison, otherwise they comparison always fails.

Library is loaded when django app starts and populate all configuration method using get_attr from settings. One of those things bypass test decorator override_settings.

It would be cool if we could configure the status code we send in responses for requests that fail. The SOON_ API Spec defines it should be a 400 since 401 and 403 are reserved for use with user authentication.

I propose a HMAC_REJECT_CODEwhich is defaulted to 403

What do you think @radeklos?