Re: Basic Authentication in the header - Authorization : Basic <key>

Hi, 

I would not recommend to mix API-Key auth and Basic Auth. 
Send it as e.g X-HTTP-APIKEY header, and in your handler function (or some 
tool function) 
inspect cherrypy.request.header

using a tool function:


def check_auth():
  needs_auth = cherrypy.request.config.get('auth.require', False)
  if needs_auth and not cherrypy.request.header.get('X-HTTP-APIKEY', None) 
== <your key here>:
     raise cherrypy.HTTPError(404) 

cherrypy.tools.auth = cherrypy.Tool('before_handler', check_auth, priority=
50)

def needsauth():
    '''A decorator that sets auth.require config
    variable.'''

    def decorate(f):
        if not hasattr(f, '_cp_config'):
            f._cp_config = dict()
        if 'auth.require' not in f._cp_config:
            f._cp_config['auth.require'] = []
        f._cp_config['auth.require'] = True
        return f

    return decorate

@cherrypy.expose
@needsauth
def myfunction(....):
  .....


Björn




Am Donnerstag, 5. April 2018 08:14:06 UTC+2 schrieb ElliotB:
>
> I've reviewed the documentation at 
> http://cherrypy.readthedocs.io/en/latest/basics.html#authentication in 
> order to understand how to send my API call to Cherrypy and validate an API 
> key that I'll have in the header of the HTTP request that I'll send from my 
> client side program. The header will follow Basic Authorization with the 
> header having the following example key and value Example: Authorization: 
> Basic YWxhZGRpbjpvcGVuc2VzYW1l
>
> Then I want the Cherrypy function that I write to run only after some 
> authorization has be completed. From the client, I'll call my function 
> like: https:///myfunction?param1=value&param2=value&param3=value with the 
> Basic Authorization header set up as seen above
>
> and in Cherrypy I'll code the function like:
>
>  @cherrypy.expose
>     def myfunction(self, param1=1,param2=cat,param3=dog):
>             # do my work in the function 
>         return 
>
> Note: the function will not have a user enter any credentials. The call 
> will pre-populate the basic authorization header programmatically.
>
> Can you set up the Cherrypy code example in such a way to explicitly show 
> me how this can be achieved. Assume a beginner with Cherrypy (e.g. did the 
> first 5 or so tutorials only ( 
> http://docs.cherrypy.org/en/latest/tutorials.html#tutorials ). Thanks 
> much.
>
>

-- 
You received this message because you are subscribed to the Google Groups "cherrypy-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cherrypy-users+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/[email protected]
To post to this group, send email to cherrypy-users-/JYPxA39Uh5TLH3MbocFF+G/[email protected]
Visit this group at https://groups.google.com/group/cherrypy-users.
For more options, visit https://groups.google.com/d/optout.