Skip to content

Commit bda81b3

Browse files
hoylenOmer Katz
hoylen
and
Omer Katz
authoredJun 3, 2020
OAuth 1.0a signature methods: RSA-SHA256, RSA-SHA512 and HMAC-SHA512 (oauthlib#723)
* Adding support for RSA-SHA256. * Added support for HMAC-SHA512, RSA-SHA256 and RSA-SHA512 signature methods. * Made version dependencies consistent. * Updated OAuth1 signature tests. * Fixed parsing of netloc/host. Deprecated old functions. * Refactored and expanded tests to include signature validate. * Update docs for HMAC-SHA512, RSA-SHA256 and RSA-SHA512 signature methods. * Updated code comments in oauth1 signatures module. * Updated changelog. * Update docs/feature_matrix.rst Co-Authored-By: Omer Katz <[email protected]> * Used parenthesis instead of backslash to break lines. * Fixed typo Co-authored-by: Omer Katz <[email protected]> Co-authored-by: Omer Katz <[email protected]>
1 parent 0404b48 commit bda81b3

File tree

12 files changed

+1604
-802
lines changed

12 files changed

+1604
-802
lines changed
 

‎CHANGELOG.rst

+4
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,10 @@ OAuth1.0 Client
4747

4848
* #669: Add case-insensitive headers to oauth1 `BaseEndpoint`
4949

50+
OAuth1.0
51+
52+
* #722: Added support for HMAC-SHA512, RSA-SHA256 and RSA-SHA512 signature methods.
53+
5054
3.0.2 (2019-07-04)
5155
------------------
5256
* #650: Fixed space encoding in base string URI used in the signature base string.

‎docs/faq.rst

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ What parts of OAuth 1 & 2 are supported?
1212
See :doc:`feature_matrix`.
1313

1414
OAuth 1 with RSA-SHA1 signatures says "could not import cryptography". What should I do?
15-
----------------------------------------------------------------------------------
15+
----------------------------------------------------------------------------------------
1616

1717
Install oauthlib with rsa flag or install cryptography manually via pip.
1818

‎docs/feature_matrix.rst

+66-35
Original file line numberDiff line numberDiff line change
@@ -1,58 +1,89 @@
11
Supported features and platforms
22
================================
33

4-
OAuth 1 is fully supported per the RFC for both clients and providers.
5-
Extensions and variations that are outside the spec are not supported.
4+
Features
5+
--------
66

7-
- HMAC-SHA1, RSA-SHA1 and plaintext signatures.
8-
- Signature placement in header, url or body.
7+
OAuth 1.0a
8+
..........
9+
10+
OAuth 1.0a is fully supported for both clients and providers.
11+
12+
All standard *signature methods* defined in `RFC 5849`_ *The OAuth 1.0
13+
Protocol* are supported:
14+
15+
- HMAC-SHA1
16+
- RSA-SHA1
17+
- PLAINTEXT
18+
19+
Non-standard *signature methods* that replaces SHA-1 with stronger
20+
digest algorithms are also supported:
21+
22+
- HMAC-SHA256
23+
- HMAC-SHA512
24+
- RSA-SHA256
25+
- RSA-SHA512
26+
27+
The OAuth 1.0a signature can be placed in the header, URL or body of
28+
the request.
29+
30+
OAuth 2.0
31+
.........
932

1033
OAuth 2.0 client and provider support for:
1134

12-
- `RFC6749#section-4.1`_: Authorization Code Grant
13-
- `RFC6749#section-4.2`_: Implicit Grant
14-
- `RFC6749#section-4.3`_: Resource Owner Password Credentials Grant
15-
- `RFC6749#section-4.4`_: Client Credentials Grant
16-
- `RFC6749#section-6`_: Refresh Tokens
17-
- `RFC6750`_: Bearer Tokens
18-
- `RFC7009`_: Token Revocation
19-
- `RFC Draft MAC tokens`_
35+
- `RFC 6749 section-4.1`_: Authorization Code Grant
36+
- `RFC 6749 section-4.2`_: Implicit Grant
37+
- `RFC 6749 section-4.3`_: Resource Owner Password Credentials Grant
38+
- `RFC 6749 section-4.4`_: Client Credentials Grant
39+
- `RFC 6749 section-6`_: Refresh Tokens
40+
- `RFC 6750`_: Bearer Tokens
41+
- `RFC 7009`_: Token Revocation
42+
- `RFC Draft`_ Message Authentication Code (MAC) Tokens
2043
- OAuth2.0 Provider: `OpenID Connect Core`_
21-
- OAuth2.0 Provider: `RFC7636`_: Proof Key for Code Exchange by OAuth Public Clients (PKCE)
22-
- OAuth2.0 Provider: `RFC7662`_: Token Introspection
23-
- OAuth2.0 Provider: `RFC8414`_: Authorization Server Metadata
44+
- OAuth2.0 Provider: `RFC 7636`_: Proof Key for Code Exchange by OAuth Public Clients (PKCE)
45+
- OAuth2.0 Provider: `RFC 7662`_: Token Introspection
46+
- OAuth2.0 Provider: `RFC 8414`_: Authorization Server Metadata
2447

2548
Features to be implemented (any help/PR are welcomed):
2649

2750
- OAuth2.0 **Client**: `OpenID Connect Core`_
28-
- OAuth2.0 **Client**: `RFC7636`_: Proof Key for Code Exchange by OAuth Public Clients (PKCE)
29-
- OAuth2.0 **Client**: `RFC7662`_: Token Introspection
30-
- OAuth2.0 **Client**: `RFC8414`_: Authorization Server Metadata
51+
- OAuth2.0 **Client**: `RFC 7636`_: Proof Key for Code Exchange by OAuth Public Clients (PKCE)
52+
- OAuth2.0 **Client**: `RFC 7662`_: Token Introspection
53+
- OAuth2.0 **Client**: `RFC 8414`_: Authorization Server Metadata
3154
- SAML2
3255
- Bearer JWT as Client Authentication
3356
- Dynamic client registration
3457
- OpenID Discovery
3558
- OpenID Session Management
3659
- ...and more
3760

38-
Supported platforms
39-
-------------------
61+
Platforms
62+
---------
63+
64+
OAuthLib is mainly developed and tested on 64-bit Linux. It works on
65+
Unix and Unix-like operating systems (including macOS), as well as
66+
Microsoft Windows.
67+
68+
It should work on any platform that supports Python, if features
69+
requiring RSA public-key cryptography is not used.
4070

41-
OAuthLib is mainly developed/tested on 64 bit Linux but works on Unix (incl. OS
42-
X) and Windows as well. Unless you are using the RSA features of OAuth 1 you
43-
should be able to use OAuthLib on any platform that supports Python. If you use
44-
RSA you are limited to the platforms supported by `cryptography`_.
71+
If features requiring RSA public-key cryptography is used (e.g
72+
RSA-SHA1 and RS256), it should work on any platform supported by
73+
PyCA's `cryptography`_ package. RSA features require installing
74+
additional packages: see the installation instructions for details.
4575

4676
.. _`cryptography`: https://cryptography.io/en/latest/installation/
47-
.. _`RFC6749#section-4.1`: https://tools.ietf.org/html/rfc6749#section-4.1
48-
.. _`RFC6749#section-4.2`: https://tools.ietf.org/html/rfc6749#section-4.2
49-
.. _`RFC6749#section-4.3`: https://tools.ietf.org/html/rfc6749#section-4.3
50-
.. _`RFC6749#section-4.4`: https://tools.ietf.org/html/rfc6749#section-4.4
51-
.. _`RFC6749#section-6`: https://tools.ietf.org/html/rfc6749#section-6
52-
.. _`RFC6750`: https://tools.ietf.org/html/rfc6750
53-
.. _`RFC Draft MAC tokens`: https://tools.ietf.org/id/draft-ietf-oauth-v2-http-mac-02.html
54-
.. _`RFC7009`: https://tools.ietf.org/html/rfc7009
55-
.. _`RFC7662`: https://tools.ietf.org/html/rfc7662
56-
.. _`RFC7636`: https://tools.ietf.org/html/rfc7636
77+
.. _`RFC 5849`: https://tools.ietf.org/html/rfc5849
78+
.. _`RFC 6749 section-4.1`: https://tools.ietf.org/html/rfc6749#section-4.1
79+
.. _`RFC 6749 section-4.2`: https://tools.ietf.org/html/rfc6749#section-4.2
80+
.. _`RFC 6749 section-4.3`: https://tools.ietf.org/html/rfc6749#section-4.3
81+
.. _`RFC 6749 section-4.4`: https://tools.ietf.org/html/rfc6749#section-4.4
82+
.. _`RFC 6749 section-6`: https://tools.ietf.org/html/rfc6749#section-6
83+
.. _`RFC 6750`: https://tools.ietf.org/html/rfc6750
84+
.. _`RFC Draft`: https://tools.ietf.org/id/draft-ietf-oauth-v2-http-mac-02.html
85+
.. _`RFC 7009`: https://tools.ietf.org/html/rfc7009
86+
.. _`RFC 7662`: https://tools.ietf.org/html/rfc7662
87+
.. _`RFC 7636`: https://tools.ietf.org/html/rfc7636
5788
.. _`OpenID Connect Core`: https://openid.net/specs/openid-connect-core-1_0.html
58-
.. _`RFC8414`: https://tools.ietf.org/html/rfc8414
89+
.. _`RFC 8414`: https://tools.ietf.org/html/rfc8414

‎docs/installation.rst

+98-22
Original file line numberDiff line numberDiff line change
@@ -1,71 +1,147 @@
11
Installing OAuthLib
22
===================
33

4-
The recommended way to install OAuthLib is from PyPI but if you are running
5-
into a bug or want to try out recently implemented features you will want to
6-
try installing directly from the GitHub master branch.
74

8-
For various reasons you may wish to install using your OS packaging system and
9-
install instructions for a few are shown below. Please send a PR to add a
10-
missing one.
5+
Install from PyPI
6+
-----------------
7+
8+
The recommended way to install OAuthLib is from PyPI using the *pip*
9+
program. Either just the *standard install* by itself or *with extras
10+
for RSA*.
1111

12-
Latest release on PyPI
13-
----------------------
12+
Standard install
13+
^^^^^^^^^^^^^^^^
1414

15+
A standard installation contains the core features of OAuthLib. It can
16+
be installed by running:
1517

1618
.. code-block:: bash
1719
1820
pip install oauthlib
1921
20-
Bleeding edge from GitHub master
21-
--------------------------------
22+
To reduce its requirements, the Python packages needed for RSA
23+
public-key cryptography are not included in the standard installation.
24+
25+
26+
With extras for RSA
27+
^^^^^^^^^^^^^^^^^^^
28+
29+
To support features that use RSA public-key cryptography, PyCA's
30+
`cryptography`_ package and the `PyJWT`_ package must also be
31+
installed. This can be done by installing the core features of
32+
OAuthLib along with the "signedtoken" extras.
2233

2334
.. code-block:: bash
2435
25-
pip install -e git+https://github.com/oauthlib/oauthlib.git#egg=oauthlib
36+
pip install 'oauthlib[signedtoken]'
37+
38+
Note: the quotes may be required, since shells can interpret the
39+
square brackets as special characters.
40+
41+
Alternatively, those two Python packages can be installed manually by
42+
running ``pip install cryptography`` and ``pip install pyjwt``, either
43+
before or after installing the standard installation of OAuthLib.
44+
PyJWT depends on cryptography, so just installing *pyjwt* should
45+
automatically also install *cryptography*. But *cryptography* has
46+
dependencies that can cause its installation to fail, so it can be
47+
better to get it installed before installing PyJWT.
48+
49+
Install from operating system distribution
50+
------------------------------------------
51+
52+
Alternatively, install it from the operating system distribution's
53+
packaging system, if OAuthLib is available as a distribution package.
54+
Install instructions for some distributions are shown below.
55+
56+
The distribution packages usually only contain the standard install of
57+
OAuthLib. To enable support for RSA, the *cryptography* and *pyjwt*
58+
Python packages also need to be installed: either from the
59+
distribution packages (if available) or from PyPI.
2660

2761
Debian and derivatives like Ubuntu, Mint, etc.
28-
---------------------------------------------
62+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
2963

3064
.. code-block:: bash
3165
32-
apt-get install python-oauthlib
3366
apt-get install python3-oauthlib
3467
35-
Redhat and Fedora
36-
-----------------
68+
The Python2 package is called "python-oauthlib".
69+
70+
RHEL, CentOS and Fedora
71+
^^^^^^^^^^^^^^^^^^^^^^^
3772

3873
.. code-block:: bash
3974
40-
yum install python-oauthlib
4175
yum install python3-oauthlib
4276
77+
The Python2 package is called "python2-oauthlib", and is available on
78+
some distributions (e.g.Fedora 31 and CentOS 7) but not available on
79+
others (e.g. CentOS 8).
80+
81+
For CentOS, the Python3 package is only available on CentOS 8 and
82+
higher.
83+
4384
openSUSE
44-
--------
85+
^^^^^^^^
4586

4687
.. code-block:: bash
4788
48-
zypper in python-oauthlib
4989
zypper in python3-oauthlib
5090
91+
The Python2 package is called "python-oauthlib".
92+
5193
Gentoo
52-
------
94+
^^^^^^
5395

5496
.. code-block:: bash
5597
5698
emerge oauthlib
5799
58100
Arch
59-
----
101+
^^^^
60102

61103
.. code-block:: bash
62104
63105
pacman -S python-oauthlib
64-
pacman -S python2-oauthlib
106+
107+
The Python2 package is called "python2-oauthlib".
65108

66109
FreeBSD
67-
-------
110+
^^^^^^^
68111

69112
.. code-block:: bash
70113
71114
pkg_add -r security/py-oauthlib/
115+
116+
117+
Install from GitHub
118+
-------------------
119+
120+
Alternatively, install it directly from the source repository on
121+
GitHub. This is the "bleading edge" version, but it may be useful for
122+
accessing bug fixes and/or new features that have not been released.
123+
124+
Standard install
125+
^^^^^^^^^^^^^^^^
126+
127+
The standard installation contains the core features of OAuthLib.
128+
129+
.. code-block:: bash
130+
131+
pip install -e git+https://github.com/oauthlib/oauthlib.git#egg=oauthlib
132+
133+
With extras for RSA
134+
^^^^^^^^^^^^^^^^^^^
135+
136+
To support features that use RSA public-key cryptography, install the
137+
core features of OAuthLib along with the "signedtoken" extras.
138+
139+
.. code-block:: bash
140+
141+
pip install -e 'git+https://github.com/oauthlib/oauthlib.git#egg=oauthlib[signedtoken]'
142+
143+
Note: the quotes may be required, since shells can interpret the
144+
square brackets as special characters.
145+
146+
.. _`cryptography`: https://cryptography.io/
147+
.. _`PyJWT`: https://pyjwt.readthedocs.io/

‎docs/oauth2/endpoints/metadata.rst

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
Metadata endpoint
33
===================
44

5-
OAuth2.0 Authorization Server Metadata (`RFC8414`_) endpoint provide the metadata of your authorization server. Since the metadata results can be a combination of OAuthlib's Endpoint (see :doc:`preconfigured_servers`), the MetadataEndpoint's class takes a list of Endpoints in parameter, and aggregate the metadata in the response.
5+
OAuth2.0 Authorization Server Metadata (`RFC8414`_) endpoint provide the metadata of your authorization server. Since the metadata results can be a combination of OAuthlib's Endpoint (see :doc:`/oauth2/preconfigured_servers`), the MetadataEndpoint's class takes a list of Endpoints in parameter, and aggregate the metadata in the response.
66

77
See below an example of usage with `bottle-oauthlib`_ when using a `LegacyApplicationServer` (password grant) endpoint:
88

‎oauthlib/oauth1/__init__.py

+20-13
Original file line numberDiff line numberDiff line change
@@ -5,17 +5,24 @@
55
This module is a wrapper for the most recent implementation of OAuth 1.0 Client
66
and Server classes.
77
"""
8-
from .rfc5849 import (
9-
SIGNATURE_HMAC, SIGNATURE_HMAC_SHA1, SIGNATURE_HMAC_SHA256,
10-
SIGNATURE_PLAINTEXT, SIGNATURE_RSA, SIGNATURE_TYPE_AUTH_HEADER,
11-
SIGNATURE_TYPE_BODY, SIGNATURE_TYPE_QUERY, Client,
12-
)
13-
from .rfc5849.endpoints import (
14-
AccessTokenEndpoint, AuthorizationEndpoint, RequestTokenEndpoint,
15-
ResourceEndpoint, SignatureOnlyEndpoint, WebApplicationServer,
16-
)
17-
from .rfc5849.errors import (
18-
InsecureTransportError, InvalidClientError, InvalidRequestError,
19-
InvalidSignatureMethodError, OAuth1Error,
20-
)
8+
from .rfc5849 import Client
9+
from .rfc5849 import (SIGNATURE_HMAC,
10+
SIGNATURE_HMAC_SHA1,
11+
SIGNATURE_HMAC_SHA256,
12+
SIGNATURE_HMAC_SHA512,
13+
SIGNATURE_RSA,
14+
SIGNATURE_RSA_SHA1,
15+
SIGNATURE_RSA_SHA256,
16+
SIGNATURE_RSA_SHA512,
17+
SIGNATURE_PLAINTEXT)
18+
from .rfc5849 import SIGNATURE_TYPE_AUTH_HEADER, SIGNATURE_TYPE_QUERY
19+
from .rfc5849 import SIGNATURE_TYPE_BODY
2120
from .rfc5849.request_validator import RequestValidator
21+
from .rfc5849.endpoints import RequestTokenEndpoint, AuthorizationEndpoint
22+
from .rfc5849.endpoints import AccessTokenEndpoint, ResourceEndpoint
23+
from .rfc5849.endpoints import SignatureOnlyEndpoint, WebApplicationServer
24+
from .rfc5849.errors import (InsecureTransportError,
25+
InvalidClientError,
26+
InvalidRequestError,
27+
InvalidSignatureMethodError,
28+
OAuth1Error)

‎oauthlib/oauth1/rfc5849/__init__.py

+45-5
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,19 @@
44
55
This module is an implementation of various logic needed
66
for signing and checking OAuth 1.0 RFC 5849 requests.
7+
8+
It supports all three standard signature methods defined in RFC 5849:
9+
10+
- HMAC-SHA1
11+
- RSA-SHA1
12+
- PLAINTEXT
13+
14+
It also supports signature methods that are not defined in RFC 5849. These are
15+
based on the standard ones but replace SHA-1 with the more secure SHA-256:
16+
17+
- HMAC-SHA256
18+
- RSA-SHA256
19+
720
"""
821
import base64
922
import hashlib
@@ -18,14 +31,38 @@
1831

1932
log = logging.getLogger(__name__)
2033

21-
34+
# Available signature methods
35+
#
36+
# Note: SIGNATURE_HMAC and SIGNATURE_RSA are kept for backward compatibility
37+
# with previous versions of this library, when it the only HMAC-based and
38+
# RSA-based signature methods were HMAC-SHA1 and RSA-SHA1. But now that it
39+
# supports other hashing algorithms besides SHA1, explicitly identifying which
40+
# hashing algorithm is being used is recommended.
41+
#
42+
# Note: if additional values are defined here, don't forget to update the
43+
# imports in "../__init__.py" so they are available outside this module.
2244

2345
SIGNATURE_HMAC_SHA1 = "HMAC-SHA1"
2446
SIGNATURE_HMAC_SHA256 = "HMAC-SHA256"
25-
SIGNATURE_HMAC = SIGNATURE_HMAC_SHA1
26-
SIGNATURE_RSA = "RSA-SHA1"
47+
SIGNATURE_HMAC_SHA512 = "HMAC-SHA512"
48+
SIGNATURE_HMAC = SIGNATURE_HMAC_SHA1 # deprecated variable for HMAC-SHA1
49+
50+
SIGNATURE_RSA_SHA1 = "RSA-SHA1"
51+
SIGNATURE_RSA_SHA256 = "RSA-SHA256"
52+
SIGNATURE_RSA_SHA512 = "RSA-SHA512"
53+
SIGNATURE_RSA = SIGNATURE_RSA_SHA1 # deprecated variable for RSA-SHA1
54+
2755
SIGNATURE_PLAINTEXT = "PLAINTEXT"
28-
SIGNATURE_METHODS = (SIGNATURE_HMAC_SHA1, SIGNATURE_HMAC_SHA256, SIGNATURE_RSA, SIGNATURE_PLAINTEXT)
56+
57+
SIGNATURE_METHODS = (
58+
SIGNATURE_HMAC_SHA1,
59+
SIGNATURE_HMAC_SHA256,
60+
SIGNATURE_HMAC_SHA512,
61+
SIGNATURE_RSA_SHA1,
62+
SIGNATURE_RSA_SHA256,
63+
SIGNATURE_RSA_SHA512,
64+
SIGNATURE_PLAINTEXT
65+
)
2966

3067
SIGNATURE_TYPE_AUTH_HEADER = 'AUTH_HEADER'
3168
SIGNATURE_TYPE_QUERY = 'QUERY'
@@ -40,7 +77,10 @@ class Client:
4077
SIGNATURE_METHODS = {
4178
SIGNATURE_HMAC_SHA1: signature.sign_hmac_sha1_with_client,
4279
SIGNATURE_HMAC_SHA256: signature.sign_hmac_sha256_with_client,
43-
SIGNATURE_RSA: signature.sign_rsa_sha1_with_client,
80+
SIGNATURE_HMAC_SHA512: signature.sign_hmac_sha512_with_client,
81+
SIGNATURE_RSA_SHA1: signature.sign_rsa_sha1_with_client,
82+
SIGNATURE_RSA_SHA256: signature.sign_rsa_sha256_with_client,
83+
SIGNATURE_RSA_SHA512: signature.sign_rsa_sha512_with_client,
4484
SIGNATURE_PLAINTEXT: signature.sign_plaintext_with_client
4585
}
4686

‎oauthlib/oauth1/rfc5849/endpoints/base.py

+45-16
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,12 @@
1111
from oauthlib.common import CaseInsensitiveDict, Request, generate_token
1212

1313
from .. import (
14-
CONTENT_TYPE_FORM_URLENCODED, SIGNATURE_HMAC_SHA1, SIGNATURE_HMAC_SHA256,
15-
SIGNATURE_RSA, SIGNATURE_TYPE_AUTH_HEADER, SIGNATURE_TYPE_BODY,
16-
SIGNATURE_TYPE_QUERY, errors, signature, utils,
17-
)
14+
CONTENT_TYPE_FORM_URLENCODED,
15+
SIGNATURE_HMAC_SHA1, SIGNATURE_HMAC_SHA256, SIGNATURE_HMAC_SHA512,
16+
SIGNATURE_RSA_SHA1, SIGNATURE_RSA_SHA256, SIGNATURE_RSA_SHA512,
17+
SIGNATURE_PLAINTEXT,
18+
SIGNATURE_TYPE_AUTH_HEADER, SIGNATURE_TYPE_BODY,
19+
SIGNATURE_TYPE_QUERY, errors, signature, utils)
1820

1921

2022
class BaseEndpoint:
@@ -179,38 +181,65 @@ def _check_mandatory_parameters(self, request):
179181

180182
def _check_signature(self, request, is_token_request=False):
181183
# ---- RSA Signature verification ----
182-
if request.signature_method == SIGNATURE_RSA:
184+
if request.signature_method == SIGNATURE_RSA_SHA1 or \
185+
request.signature_method == SIGNATURE_RSA_SHA256 or \
186+
request.signature_method == SIGNATURE_RSA_SHA512:
187+
# RSA-based signature method
188+
183189
# The server verifies the signature per `[RFC3447] section 8.2.2`_
184190
# .. _`[RFC3447] section 8.2.2`: https://tools.ietf.org/html/rfc3447#section-8.2.1
191+
185192
rsa_key = self.request_validator.get_rsa_key(
186193
request.client_key, request)
187-
valid_signature = signature.verify_rsa_sha1(request, rsa_key)
194+
195+
if request.signature_method == SIGNATURE_RSA_SHA1:
196+
valid_signature = signature.verify_rsa_sha1(request, rsa_key)
197+
elif request.signature_method == SIGNATURE_RSA_SHA256:
198+
valid_signature = signature.verify_rsa_sha256(request, rsa_key)
199+
elif request.signature_method == SIGNATURE_RSA_SHA512:
200+
valid_signature = signature.verify_rsa_sha512(request, rsa_key)
201+
else:
202+
valid_signature = False
188203

189204
# ---- HMAC or Plaintext Signature verification ----
190205
else:
206+
# Non-RSA based signature method
207+
191208
# Servers receiving an authenticated request MUST validate it by:
192209
# Recalculating the request signature independently as described in
193210
# `Section 3.4`_ and comparing it to the value received from the
194211
# client via the "oauth_signature" parameter.
195212
# .. _`Section 3.4`: https://tools.ietf.org/html/rfc5849#section-3.4
213+
196214
client_secret = self.request_validator.get_client_secret(
197215
request.client_key, request)
216+
198217
resource_owner_secret = None
199218
if request.resource_owner_key:
200219
if is_token_request:
201-
resource_owner_secret = self.request_validator.get_request_token_secret(
202-
request.client_key, request.resource_owner_key, request)
220+
resource_owner_secret = \
221+
self.request_validator.get_request_token_secret(
222+
request.client_key, request.resource_owner_key,
223+
request)
203224
else:
204-
resource_owner_secret = self.request_validator.get_access_token_secret(
205-
request.client_key, request.resource_owner_key, request)
225+
resource_owner_secret = \
226+
self.request_validator.get_access_token_secret(
227+
request.client_key, request.resource_owner_key,
228+
request)
206229

207230
if request.signature_method == SIGNATURE_HMAC_SHA1:
208-
valid_signature = signature.verify_hmac_sha1(request,
209-
client_secret, resource_owner_secret)
231+
valid_signature = signature.verify_hmac_sha1(
232+
request, client_secret, resource_owner_secret)
210233
elif request.signature_method == SIGNATURE_HMAC_SHA256:
211-
valid_signature = signature.verify_hmac_sha256(request,
212-
client_secret, resource_owner_secret)
234+
valid_signature = signature.verify_hmac_sha256(
235+
request, client_secret, resource_owner_secret)
236+
elif request.signature_method == SIGNATURE_HMAC_SHA512:
237+
valid_signature = signature.verify_hmac_sha512(
238+
request, client_secret, resource_owner_secret)
239+
elif request.signature_method == SIGNATURE_PLAINTEXT:
240+
valid_signature = signature.verify_plaintext(
241+
request, client_secret, resource_owner_secret)
213242
else:
214-
valid_signature = signature.verify_plaintext(request,
215-
client_secret, resource_owner_secret)
243+
valid_signature = False
244+
216245
return valid_signature

‎oauthlib/oauth1/rfc5849/signature.py

+491-383
Large diffs are not rendered by default.

‎oauthlib/oauth2/rfc6749/endpoints/metadata.py

+4-4
Original file line numberDiff line numberDiff line change
@@ -161,10 +161,10 @@ def validate_metadata_server(self):
161161
response_types_supported
162162
REQUIRED.
163163
164-
* Other OPTIONAL fields:
165-
jwks_uri
166-
registration_endpoint
167-
response_modes_supported
164+
Other OPTIONAL fields:
165+
jwks_uri,
166+
registration_endpoint,
167+
response_modes_supported
168168
169169
grant_types_supported
170170
OPTIONAL. JSON array containing a list of the OAuth 2.0 grant

‎setup.py

+3-3
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,9 @@ def fread(fn):
1616
return f.read()
1717

1818

19-
rsa_require = ['cryptography']
20-
signedtoken_require = ['cryptography', 'pyjwt>=1.0.0']
21-
signals_require = ['blinker']
19+
rsa_require = ['cryptography>=1.4.0']
20+
signedtoken_require = ['cryptography>=1.4.0', 'pyjwt>=1.6.0']
21+
signals_require = ['blinker>=1.4.0']
2222

2323
setup(
2424
name='oauthlib',

‎tests/oauth1/rfc5849/test_signatures.py

+826-319
Large diffs are not rendered by default.

0 commit comments

Comments
 (0)
Please sign in to comment.