A generic, spec-compliant, thorough implementation of the OAuth request-signing logic

Related tags

Authentication python identity oauth library oauth2 authentication python3 authorization oauth1 python-3 jwt-bearer-tokens openid-connect python-2 jwt-authentication python2 oidc token-based-authentication oidc-provider
Overview

OAuthLib - Python Framework for OAuth1 & OAuth2

*A generic, spec-compliant, thorough implementation of the OAuth request-signing logic for Python 3.5+.

Travis Coveralls Download from PyPI License FOSSA Status Read the Docs Chat on Gitter OAuth + Python = OAuthlib Python Framework

OAuth often seems complicated and difficult-to-implement. There are several prominent libraries for handling OAuth requests, but they all suffer from one or both of the following:

  1. They predate the OAuth 1.0 spec, AKA RFC 5849.
  2. They predate the OAuth 2.0 spec, AKA RFC 6749.
  3. They assume the usage of a specific HTTP request library.

OAuthLib is a framework which implements the logic of OAuth1 or OAuth2 without assuming a specific HTTP request object or web framework. Use it to graft OAuth client support onto your favorite HTTP library, or provide support onto your favourite web framework. If you're a maintainer of such a library, write a thin veneer on top of OAuthLib and get OAuth support for very little effort.

Documentation

Full documentation is available on Read the Docs. All contributions are very welcome! The documentation is still quite sparse, please open an issue for what you'd like to know, or discuss it in our Gitter community, or even better, send a pull request!

Interested in making OAuth requests?

Then you might be more interested in using requests which has OAuthLib powered OAuth support provided by the requests-oauthlib library.

Which web frameworks are supported?

The following packages provide OAuth support using OAuthLib.

If you have written an OAuthLib package that supports your favorite framework, please open a Pull Request, updating the documentation.

Using OAuthLib? Please get in touch!

Patching OAuth support onto an http request framework? Creating an OAuth provider extension for a web framework? Simply using OAuthLib to Get Things Done or to learn?

No matter which we'd love to hear from you in our Gitter community or if you have anything in particular you would like to have, change or comment on don't hesitate for a second to send a pull request or open an issue. We might be quite busy and therefore slow to reply but we love feedback!

Chances are you have run into something annoying that you wish there was documentation for, if you wish to gain eternal fame and glory, and a drink if we have the pleasure to run into eachother, please send a docs pull request =)

License

OAuthLib is yours to use and abuse according to the terms of the BSD license. Check the LICENSE file for full details.

Credits

OAuthLib has been started and maintained several years by Idan Gazit and other amazing AUTHORS. Thanks to their wonderful work, the open-source community creation has been possible and the project can stay active and reactive to users requests.

Changelog

OAuthLib is in active development, with the core of both OAuth1 and OAuth2 completed, for providers as well as clients. See supported features for details.

For a full changelog see CHANGELOG.rst.

Comments
  • OpenID Connect

    OpenID Connect

    Hello,

    I've been reading the OpenID Connect spec to implement it on top of Django-OAuth-Toolkit, but I think this feature belongs to oauthlib, what do you think?

    I have some code (inside DOT, not oauthlib) which defines a new server and grant_types needed to succesfully process an OIDC Authorization Request. If you agree, I'll move that to my fork of oauthlib and write proper tests covering the spec.

    opened by lsmag 44
  • Needs more maintainers

    Needs more maintainers

    I'm currently the only one who maintains oauthlib and I barely have the time to do so right now. Who has some time on his hands to review the current PRs, write tests if they are missing for those PRs and release a new version?

    opened by thedrow 31
  • Openid connect jwt

    Openid connect jwt

    This pull request adds support to receive JWT token in request in the following form:

    curl -vv --header "Content-Type: application/json" \
         --header "Accept: application/json; indent=4" \
         --header "Authorization: Bearer eyJhbGciOiAiUlMyNTYifQ..." \
         http://127.0.0.1:8000/v1/users/
...
> GET /v1/users/ HTTP/1.1
> Host: 127.0.0.1:8000
> User-Agent: curl/7.53.1
> Content-Type: application/json
> Accept: application/json; indent=4
> Authorization: Bearer eyJhbGciOiAiUlMyNTYifQ....
> 
* HTTP 1.0, assume close after body
< HTTP/1.0 200 OK
< Date: Sun, 01 Oct 2017 19:53:52 GMT
< Server: WSGIServer/0.2 CPython/3.6.2
< Content-Type: application/json
< Vary: Accept
< Allow: GET, POST, HEAD, OPTIONS
< X-Frame-Options: SAMEORIGIN
< Content-Length: 159
< 
[
    {
        "url": "http://127.0.0.1:8000/v1/users/1/",
        "username": "wiliam",
        "email": "[email protected]",
        "is_staff": true
    }
* Closing connection 0
]

    Don't find tests for tokens.py model. Any clue?

    opened by wiliamsouza 28
  • Client web application does no longer send client_id

    Client web application does no longer send client_id

    I found a regression in master when used with requests/requests-oauthlib since https://github.com/oauthlib/oauthlib/issues/495 has been merged. It's related to authorization grant/web application only.

    Basic usage of requests-oauthlib is :

    sess = OAuth2Session(client_id)
token = sess.fetch_token(token_url, client_secret=client_secret, authorization_response=request.url)

    However, since the changes, client_id of the session is ignored. I think https://github.com/oauthlib/oauthlib/pull/505 fixed an use-case but broke another one. We should find a win-win solution.

    requests-oauthlib code call at https://github.com/requests/requests-oauthlib/blob/master/requests_oauthlib/oauth2_session.py#L196-L198 and oauthlib issue here https://github.com/oauthlib/oauthlib/blame/master/oauthlib/oauth2/rfc6749/clients/web_application.py#L128.

    Bug Discussion OAuth2-Client 
    opened by JonathanHuot 26
  • Does this provide two-legged auth as well?

    Does this provide two-legged auth as well?

    The documentation is very slim and was just wondering if this can handle two-legged auth like python-oauth2 can.

    This is what I need: https://sites.google.com/site/oauthgoog/2leggedoauth/2opensocialrestapi

    opened by sontek 22
  • OpenID connect improvements

    OpenID connect improvements

    This pull request removes the need of using grant_type=openid in token endpoint and when defining a application credential the authorization_grant_type can be same already used (authorization-code) both for OpenID Connect and OAuth2.

    OpenID Connect and OAuth2 specification links:

    • http://openid.net/specs/openid-connect-core-1_0.html#TokenRequest
    • http://openid.net/specs/openid-connect-core-1_0.html#HybridTokenEndpoint
    • https://tools.ietf.org/html/rfc6749#section-4.1.3

    To achieve this a new method get_authorization_code_scopes have to be added to RequestValidator along side news dispatches for implicit and token grant.

    Example old way to send a token request:

    curl -X POST \
    -H "Cache-Control: no-cache" \
    -H "Content-Type: application/x-www-form-urlencoded" \
    "http://127.0.0.1:8000/o/token/" \
    -d "client_id=qLSq5KfSvYRho..." \
    -d "client_secret=bhOWtOxm1..." \
    -d "code=B8J3PQBpDeHFohgrVnvs26KrTAMNhI" \
    -d "redirect_uri=http://localhost/callback" \
    -d "grant_type=openid"

    Example fixed way to send a token request:

    curl -X POST \
    -H "Cache-Control: no-cache" \
    -H "Content-Type: application/x-www-form-urlencoded" \
    "http://127.0.0.1:8000/o/token/" \
    -d "client_id=qLSq5KfSvYRho..." \
    -d "client_secret=bhOWtOxm1..." \
    -d "code=B8J3PQBpDeHFohgrVnvs26KrTAMNhI" \
    -d "redirect_uri=http://localhost/callback" \
    -d "grant_type=authorization_code"

    I successfully tested using django-oauth-toolkit the following flows:

    • Implicit Flow
      • Returning only access_token
      • Returning only id_token
      • Return access_token and id_token
    • Authorization Flow
      • Returning only access_token
      • Returning id_token
    • Hybrid flow
      • Returning code and id_token
      • Returning code and access_token
      • Returning code, id_token and access_token
    • Client credentials
    • Resource owner password based

    Adding support to OpenID Connect is a working in progress based on this pull request.

    opened by wiliamsouza 21
  • Client_secret and code_verifier (PKCE) should be transmitted securely

    Client_secret and code_verifier (PKCE) should be transmitted securely

    client_secret and code_verifier are accepted when sent as parameters in query string

    Request.client_secret should be checked for presence in headers or body and Request.code_verifier just in body but not query string as it is sensitive data. Addition checks might be done, such as request type is POST and data was sent using HTTPS.

    When client_secret or code_verifier is sent in query string it should result in Bad Request, enforcing client to send data securely.

    Bug Contributor Friendly OAuth2-Provider 
    opened by polamayster 19
  • Release 3.1.1

    Release 3.1.1

    Based on latest contributions and the previous release was not so recent, I suggest to release 3.1.1.

    That will be a good opportunity for @auvipy to make your first release, if you want ;)

    BTW: to synchronize that will be helpful if you join the oauthlib gitter community.

    Discussion 
    opened by JonathanHuot 16
  • This patch fixes PyJWT support when pyjwt >= 0.4.0

    This patch fixes PyJWT support when pyjwt >= 0.4.0

    Newer versions of pyjwt subsume a bunch of the PEM decoding stuff.

    This fixes tests with all latest deps.

    I also reformatted the PEM key strings so that they could be copied/pasted easier. PEP-8 doesn't forbid multi-line strings.

    Note that the Private Keys were retrieved by running RSA.importKey(private_pem).publickey.exportKey().

    opened by josephtate 16
  • Fix Issue #666: ban 'client_secret' and 'code_verifier' from url query params

    Fix Issue #666: ban 'client_secret' and 'code_verifier' from url query params

    Fixes for issue #666

    • Checks that ~'client_secret' and 'code_verifier' do not appear as url query params~ there are no query params
    • ~Checks are made irrespective of what kind of request it is and if those params will ever be accessed or not.~ Enforce POST HTTP method on TokenEndpoint, IntrospectEndpoint and RevocationEndpoint
    opened by Abhishek8394 15
  • Check that the Bearer header is properly formatted

    Check that the Bearer header is properly formatted

    While testing some things we noticed that passing a header with a typo like Beaver makes the app behaving like it was Bearer. I don't know if this is a desired behaviour or not but it seems odd to me. I made the check a little bit more rigid and added test cases for that. Feel free to close and kill this if this is an intended behaviour

    opened by MattBlack85 15
  • Latest version on pypi.org (3.2.2) not reflected here - is it safe?

    Latest version on pypi.org (3.2.2) not reflected here - is it safe?

    The latest version on pypi.org appears to be 3.2.2, but that version appears neither in the Changelog nor in the releases here on github. What changes does 3.2.2 on pypi contain?

    opened by nizwiz 1
  • Add classifier for Python 3.11

    Add classifier for Python 3.11

    Some tools or services like https://pyreadiness.org/ use classifiers to check for compatibility with a particular Python version. It would be nice to have classifiers for all Python versions tested with tox in setup.py.

    opened by eseifert 0
  • CI/Pipeline broken since TravisCI consumed all

    CI/Pipeline broken since TravisCI consumed all "OSS credits"

    Because we're running a OSS project, we have a 10000 credits in Travis-CI.com to run jobs. The pipeline stopped working around June, I thought initially it should be enough (https://github.com/oauthlib/oauthlib/issues/762) but apparently it is only enough for a couple of months of usage!

    I have sent an email to Travis support to see if we can have more credits dedicated to oauthlib, else we may need to switch to Github Actions before processing more pull requests.

    Thoughts anyone?

    Bug Todo Discussion Contributor Friendly 
    opened by JonathanHuot 1
  • oauth2 implicit grant does not seem to properly return the error in uri fragment when client is unauthorized to use response_type token

    oauth2 implicit grant does not seem to properly return the error in uri fragment when client is unauthorized to use response_type token

    Describe the bug

    Disclaimer: I am not entirely sure if this is a bug in oauthlib or if I messed something up in my test cases, but my code analysis makes me believe this is caused by oauthlib.

    When using the oauth2 implicit grant and the client is not authorized to use the response_type token, the error message is returned in the query but should be returned in the fragment (See RFC6749). The implicit grant correctly returns most of the other errors in the fragment, so this seems to only be an issue when calling .validate_authorization_request() manually as shown in the provider tutorial.

    How to reproduce

    The bug was encountered while using a (slightly modified) version of the example code in section 5 of the provider tutorial. The bug should occur when performing an authorization with the implicit grant using a client not authorized to use response_type token (e.g. RequestValidator.validate_response_type() returns False). The resulting redirect contains the error in the query, not the fragment.

    Expected behavior

    As stated in the RFC6749, section 4.2.2.1, the error message should be be added to the uri fragment, not the uri query.

    Additional context

    • python 3.9.2, oauthlib.__version__ == 3.2.0
    • using bottle-oauthlib for the integration with the webserver
    • the bug occurs as part of the oauth2 protocol, but I am technically already using the OIDC versions of the endpoints as I am currently upgrading.

    Code analysis

    The bug occurs because request.response_mode is not properly set by ImplicitGrant.create_token_response() (called via .validate_authorization_request() and AuthorizationEndpoint.validate_authorization_request()). In comparison, ImplicitGrant.create_token_response() seems to correctly set the response_mode in Line 230.

    Bug Contributor Friendly OAuth2-Provider 
    opened by bennr01 1
Releases(v3.2.1)

  • v3.2.1(Sep 9, 2022)

    In short

    OAuth2.0 Provider:

    • #803 : Metadata endpoint support of non-HTTPS
    • CVE-2022-36087

    OAuth1.0:

    • #818 : Allow IPv6 being parsed by signature

    General:

    • Improved and fixed documentation warnings.
    • Cosmetic changes based on isort

    What's Changed

    • add missing slots to TokenBase by @ariebovenberg in https://github.com/oauthlib/oauthlib/pull/804
    • Add CORS support for Refresh Token Grant. by @luhn in https://github.com/oauthlib/oauthlib/pull/806
    • GitHub Action to lint Python code by @cclauss in https://github.com/oauthlib/oauthlib/pull/797
    • Docs: fix Sphinx warnings for better ReadTheDocs generation by @JonathanHuot in https://github.com/oauthlib/oauthlib/pull/807
    • Allow non-HTTPS issuer when OAUTHLIB_INSECURE_TRANSPORT. by @luhn in https://github.com/oauthlib/oauthlib/pull/803
    • chore: fix typo in test by @tamanobi in https://github.com/oauthlib/oauthlib/pull/816
    • Fix typo in server.rst by @NemanjaT in https://github.com/oauthlib/oauthlib/pull/819
    • Fixed isort imports by @dasm in https://github.com/oauthlib/oauthlib/pull/820
    • docs: Fix a few typos by @timgates42 in https://github.com/oauthlib/oauthlib/pull/822
    • docs: fix typos by @kianmeng in https://github.com/oauthlib/oauthlib/pull/823

    New Contributors

    • @ariebovenberg made their first contribution in https://github.com/oauthlib/oauthlib/pull/804
    • @tamanobi made their first contribution in https://github.com/oauthlib/oauthlib/pull/816
    • @NemanjaT made their first contribution in https://github.com/oauthlib/oauthlib/pull/819
    • @kianmeng made their first contribution in https://github.com/oauthlib/oauthlib/pull/823

    Full Changelog: https://github.com/oauthlib/oauthlib/compare/v3.2.0...v3.2.1

    Source code(tar.gz)
    Source code(zip)

  • v3.2.0(Jan 29, 2022)

    Changelog

    OAuth2.0 Client:

    • #795: Add Device Authorization Flow for Web Application
    • #786: Add PKCE support for Client
    • #783: Fallback to none in case of wrong expires_at format.

    OAuth2.0 Provider:

    • #790: Add support for CORS to metadata endpoint.
    • #791: Add support for CORS to token endpoint.
    • #787: Remove comma after Bearer in WWW-Authenticate

    OAuth2.0 Provider - OIDC:

    • #755: Call save_token in Hybrid code flow
    • #751: OIDC add support of refreshing ID Tokens with refresh_id_token
    • #751: The RefreshTokenGrant modifiers now take the same arguments as the AuthorizationCodeGrant modifiers (token, token_handler, request).

    General:

    • Added Python 3.9, 3.10, 3.11
    • Improve Travis & Coverage

    New Contributors

    • @kazkansouh made their first contribution in https://github.com/oauthlib/oauthlib/pull/771
    • @riconnon made their first contribution in https://github.com/oauthlib/oauthlib/pull/777
    • @dotGiff made their first contribution in https://github.com/oauthlib/oauthlib/pull/783
    • @freeman1981 made their first contribution in https://github.com/oauthlib/oauthlib/pull/787
    • @Xpyder made their first contribution in https://github.com/oauthlib/oauthlib/pull/793
    • @rigzba21 made their first contribution in https://github.com/oauthlib/oauthlib/pull/786
    • @cclauss made their first contribution in https://github.com/oauthlib/oauthlib/pull/796
    • @kellyma2 made their first contribution in https://github.com/oauthlib/oauthlib/pull/795

    Full Changelog: https://github.com/oauthlib/oauthlib/compare/v3.1.1...v3.2.0

    Source code(tar.gz)
    Source code(zip)

  • v3.1.1(Jun 2, 2021)

    OAuth2.0 Provider - Bugfixes

    • #753: Fix acceptance of valid IPv6 addresses in URI validation

    OAuth2.0 Client - Bugfixes

    • #730: Base OAuth2 Client now has a consistent way of managing the scope: it consistently relies on the scope provided in the constructor if any, except if overridden temporarily in a method call. Note that in particular providing a non-None scope in prepare_authorization_request or prepare_refresh_token does not override anymore self.scope forever, it is just used temporarily.
    • #726: MobileApplicationClient.prepare_request_uri and MobileApplicationClient.parse_request_uri_response, ServiceApplicationClient.prepare_request_body, and WebApplicationClient.prepare_request_uri now correctly use the default scope provided in constructor.
    • #725: LegacyApplicationClient.prepare_request_body now correctly uses the default scope provided in constructor

    OAuth2.0 Provider - Bugfixes

    • #711: client_credentials grant: fix log message
    • #746: OpenID Connect Hybrid - fix nonce not passed to add_id_token
    • #756: Different prompt values are now handled according to spec (e.g. prompt=none)
    • #759: OpenID Connect - fix Authorization: Basic parsing

    General

    • #716: improved skeleton validator for public vs private client
    • #720: replace mock library with standard unittest.mock
    • #727: build isort integration
    • #734: python2 code removal
    • #735, #750: add python3.8 support
    • #749: bump minimum versions of pyjwt and cryptography
    Source code(tar.gz)
    Source code(zip)

  • v3.1.0(Aug 6, 2019)

    3.1.0 is an feature release including improvement to OIDC and security enhancements. Check-it out !

    OAuth2.0 Provider - Features

    • #660: OIDC add support of nonce, c_hash, at_hash fields
      • New RequestValidator.fill_id_token method
      • Deprecated RequestValidator.get_id_token method
    • #677: OIDC add UserInfo endpoint
      • New RequestValidator.get_userinfo_claims method

    OAuth2.0 Provider - Security

    • #665: Enhance data leak to logs
      • New default to not expose request content in logs
      • New function oauthlib.set_debug(True)
    • #666: Disabling query parameters for POST requests

    OAuth2.0 Provider - Bugfixes

    • #670: Fix validate_authorization_request to return the new PKCE fields
    • #674: Fix token_type to be case-insensitive (bearer and Bearer)

    OAuth2.0 Client - Bugfixes

    • #290: Fix Authorization Code's errors processing
    • #603: BackendApplication.Client.prepare_request_body use the "scope" argument as intended.
    • #672: Fix edge case when expires_in=Null

    OAuth1.0 Client

    • #669: Add case-insensitive headers to oauth1 BaseEndpoint
    Source code(tar.gz)
    Source code(zip)

  • v3.0.2(Jul 4, 2019)

    Bug fix release

    • #650: OAuth1: Fixed space encoding in base string URI used in the signature base string.
    • #654: OAuth2: Doc: The value state must not be stored by the AS, only returned in /authorize response.
    • #652: OIDC: Fixed /token response which wrongly returned "&state=None"
    • #656: OIDC: Fixed "nonce" checks: raise errors when it's mandatory
    Source code(tar.gz)
    Source code(zip)

  • v3.0.1(Jan 24, 2019)

    Fix regression introduced in 3.0.0

    • #644 Fixed Revocation & Introspection Endpoints when using Client Authentication with HTTP Basic Auth.
    Source code(tar.gz)
    Source code(zip)

  • v3.0.0(Jan 8, 2019)

    This is a major release containing API Breaking changes, and new major features. See the full list below:

    OAuth2.0 Provider - outstanding Features

    • OpenID Connect Core support
    • RFC7662 Introspect support
    • RFC8414 OAuth2.0 Authorization Server Metadata support (#605)
    • RFC7636 PKCE support (#617 #624)

    OAuth2.0 Provider - API/Breaking Changes

    • Add "request" to confirm_redirect_uri #504
    • confirm_redirect_uri/get_default_redirect_uri has a bit changed #445
    • invalid_client is now a FatalError #606
    • Changed errors status code from 401 to 400:
    • invalid_grant: #264
    • invalid_scope: #620
    • access_denied/unauthorized_client/consent_required/login_required #623
    • 401 must have WWW-Authenticate HTTP Header set. #623

    OAuth2.0 Provider - Bugfixes

    • empty scopes no longer raise exceptions for implicit and authorization_code #475 / #406

    OAuth2.0 Client - Bugfixes / Changes:

    • expires_in in Implicit flow is now an integer #569
    • expires is no longer overriding expires_in #506
    • parse_request_uri_response is now required #499
    • Unknown error=xxx raised by OAuth2 providers was not understood #431
    • OAuth2's prepare_token_request supports sending an empty string for client_id (#585)
    • OAuth2's WebApplicationClient.prepare_request_body was refactored to better support sending or omitting the client_id via a new include_client_id kwarg. By default this is included. The method will also emit a DeprecationWarning if a client_id parameter is submitted; the already configured self.client_id is the preferred option. (#585)

    OAuth1.0 Client:

    • Support for HMAC-SHA256 #498

    General fixes:

    • $ and ' are allowed to be unencoded in query strings #564
    • Request attributes are no longer overriden by HTTP Headers #409
    • Removed unnecessary code for handling python2.6
    • Add support of python3.7 #621
    • Several minors updates to setup.py and tox
    • Set pytest as the default unittest framework
    Source code(tar.gz)
    Source code(zip)

  • v2.1.0(May 22, 2018)

    This minor release includes the following changes:

    • Fixed some copy and paste typos (#535)
    • Use secrets module in Python 3.6 and later (#533)
    • Add request argument to confirm_redirect_uri (#504)
    • Avoid populating spurious token credentials (#542)
    • Make populate attributes API public (#546)
    Source code(tar.gz)
    Source code(zip)

  • v2.0.7(Mar 19, 2018)

    :tada: First oauthlib community release. :tada:

    • Moved oauthlib into new organization on GitHub.
    • Include license file in the generated wheel package. (#494)
    • When deploying a release to PyPI, include the wheel distribution. (#496)
    • Check access token in self.token dict. (#500)
    • Added bottle-oauthlib to docs. (#509)
    • Update repository location in Travis. (#514)
    • Updated docs for organization change. (#515)
    • Replace G+ with Gitter. (#517)
    • Update requirements. (#518)
    • Add shields for Python versions, license and RTD. (#520)
    • Fix ReadTheDocs build (#521).
    • Fixed "make" command to test upstream with local oauthlib. (#522)
    • Replace IRC notification with Gitter Hook. (#523)
    • Added Github Releases deploy provider. (#523)
    Source code(tar.gz)
    Source code(zip)

  • v2.0.6(Mar 18, 2018)

  • v2.0.5(Mar 18, 2018)

  • v2.0.4(Mar 18, 2018)

    • Fixed typo that caused OAuthlib to crash because of the fix in "Address missing OIDC errors and fix a typo in the AccountSelectionRequired exception".
    Source code(tar.gz)
    Source code(zip)

  • v2.0.3(Sep 7, 2017)

    • Address missing OIDC errors and fix a typo in the AccountSelectionRequired exception.
    • Update proxy keys on CaseInsensitiveDict.update().
    • Redirect errors according to OIDC's response_mode.
    • Added universal wheel support.
    • Added log statements to except clauses.
    • According to RC7009 Section 2.1, a client should include authentication credentials when revoking its tokens. As discussed in #339, this is not make sense for public clients. However, in that case, the public client should still be checked that is infact a public client (authenticate_client_id).
    • Improved prompt parameter validation.
    • Added two error codes from RFC 6750.
    • Hybrid response types are now be fragment-encoded.
    • Added Python 3.6 to Travis CI testing and trove classifiers.
    • Fixed BytesWarning issued when using a string placeholder for bytes object.
    • Documented PyJWT dependency and improved logging and exception messages.
    • Documentation improvements and fixes.
    Source code(tar.gz)
    Source code(zip)

  • v2.0.2(Sep 7, 2017)

    • Dropped support for Python 2.6, 3.2 & 3.3.
    • (FIX) OpenIDConnector will no longer raise an AttributeError when calling openid_authorization_validator() twice.
    Source code(tar.gz)
    Source code(zip)

  • v2.0.1(Nov 23, 2016)

  • v2.0.0(Sep 3, 2016)

  • v1.1.2(Sep 3, 2016)

    • (Fix) Query strings should be able to include colons.
    • (Fix) Cast body to a string to ensure that we can perform a regex substitution on it.
    Source code(tar.gz)
    Source code(zip)

  • 1.1.1(May 1, 2016)

  • 1.1.0(Apr 11, 2016)

    • (Fix) '(', ')', '/' and '?' are now safe characters in url encoded strings.
    • (Enhancement) Added support for specifying if refresh tokens should be created on authorization code grants.
    • (Fix) OAuth2Token now handles None scopes correctly.
    • (Fix) Request token is now available for OAuth 1.
    • (Enhancement) OAuth2Token is declared with __slots__ for smaller memory footprint.
    • (Enhancement) RefreshTokenGrant now allows to set issue_new_refresh_tokens.
    • Documentation improvements and fixes.
    Source code(tar.gz)
    Source code(zip)

  • 1.0.3(Aug 16, 2015)

    • (Fix) Changed the documented return type of the invalidate_request_token() method from the RSA key to None since nobody is using the return type.
    • (Enhancement) Added a validator log that will store what the endpoint has computed for debugging and logging purposes (OAuth 1 only for now).
    Source code(tar.gz)
    Source code(zip)

  • 1.0.2(Aug 16, 2015)

    • (Fix) Allow client secret to be null for public applications that do not mandate it's specification in the query parameters.
    • (Fix) Encode request body before hashing in order to prevent encoding errors in Python 3.
    Source code(tar.gz)
    Source code(zip)

  • 1.0.1(Jul 25, 2015)

  • 1.0.0(Jul 25, 2015)

    • (Breaking Change) Replace pycrypto with cryptography from https://cryptography.io
    • (Breaking Change) Update jwt to 1.0.0 (which is backwards incompatible) no oauthlib api changes were made.
    • (Breaking Change) Raise attribute error for non-existing attributes in the Request object.
    • (Fix) Strip whitespace off of scope string.
    • (Change) Don't require to return the state in the access token response.
    • (Change) Hide password in logs.
    • (Fix) Fix incorrect invocation of prepare_refresh_body in the OAuth2 client.
    • (Fix) Handle empty/non-parsable query strings.
    • (Fix) Check if an RSA key is actually needed before requiring it.
    • (Change) Allow tuples for list_to_scope as well as sets and lists.
    • (Change) Add code to determine if client authentication is required for OAuth2.
    • (Fix) Fix error message on invalid Content-Type header for OAtuh1 signing.
    • (Fix) Allow ! character in query strings.
    • (Fix) OAuth1 now includes the body hash for requests that specify any content-type that isn't x-www-form-urlencoded.
    • (Fix) Fixed error description in oauth1 endpoint.
    • (Fix) Revocation endpoint for oauth2 will now return an empty string in the response body instead of 'None'.
    • Increased test coverage.
    • Performance improvements.
    • Documentation improvements and fixes.
    Source code(tar.gz)
    Source code(zip)

  • 0.7.2(Jul 25, 2015)

    • (Quick fix) Unpushed locally modified files got included in the PyPI 0.7.1 release. Doing a new clean release to address this. Please upgrade quickly and report any issues you are running into.
    Source code(tar.gz)
    Source code(zip)

  • 0.7.1(Jul 25, 2015)

  • 0.7.0(Jul 25, 2015)

    • (Change) OAuth2 clients will not raise a Warning on scope change if the environment variable OAUTHLIB_RELAX_TOKEN_SCOPE is set. The token will now be available as an attribute on the error, error.token. Token changes will now also be announced using blinker.
    • (Fix/Feature) Automatic fixes of non-compliant OAuth2 provider responses (e.g. Facebook).
    • (Fix) Logging is now tiered (per file) as opposed to logging all under oauthlib.
    • (Fix) Error messages should now include a description in their message.
    • (Fix/Feature) Optional support for jsonp callbacks after token revocation.
    • (Feature) Client side preparation of OAuth 2 token revocation requests.
    • (Feature) New OAuth2 client API methods for preparing full requests.
    • (Feature) OAuth1 SignatureOnlyEndpoint that only verifies signatures and client IDs.
    • (Fix/Feature) Refresh token grant now allow optional refresh tokens.
    • (Fix) add missing state param to OAuth2 errors.
    • (Fix) add_params_to_uri now properly parse fragment.
    • (Fix/Feature) All OAuth1 errors can now be imported from oauthlib.oauth1.
    • (Fix/Security) OAuth2 logs will now strip client provided password, if present.
    • Allow unescaped @ in urlencoded parameters.
    Source code(tar.gz)
    Source code(zip)

  • 0.6.3(Jul 25, 2015)

  • 0.6.2(Jul 25, 2015)

    • Numerous OAuth2 provider errors now suggest a status code of 401 instead of 400 (#247).
    • Added support for JSON web tokens with oauthlib.common.generate_signed_token. Install extra dependency with oauthlibsignedtoken.
    • OAuth2 scopes can be arbitrary objects with str defined (#240).
    • OAuth 1 Clients can now register custom signature methods (#239).
    • Exposed new method oauthlib.oauth2.is_secure_transport that checks whether the given URL is HTTPS. Checks using this method can be disabled by setting the environment variable OAUTHLIB_INSECURE_TRANSPORT (#249).
    • OAuth1 clients now has repr and will be printed with secrets scrubbed.
    • OAuth1 Client.get_oauth_params now takes an oauthlib.Request as an argument.
    • urldecode will now raise a much more informative error message on incorrectly encoded strings.
    • Plenty of typo and other doc fixes.
    Source code(tar.gz)
    Source code(zip)

  • 0.6.1(Jul 25, 2015)

    Draft revocation endpoint features and numerous fixes including:

    • (OAuth 2 Provider) is_within_original_scope to check whether a refresh token is trying to aquire a new set of scopes that are a subset of the original scope.
    • (OAuth 2 Provider) expires_in token lifetime can be set per request.
    • (OAuth 2 Provider) client_authentication_required method added to differentiate between public and confidential clients.
    • (OAuth 2 Provider) rotate_refresh_token now indicates whether a new refresh token should be generated during token refresh or if old should be kept.
    • (OAuth 2 Provider) returned JSON headers no longer include charset.
    • (OAuth 2 Provider) validate_authorizatoin_request now also includes the internal request object in the returned dictionary. Note that this is not meant to be relied upon heavily and its interface might change.
    • and many style and typo fixes.
    Source code(tar.gz)
    Source code(zip)

  • 0.6.0(Jul 25, 2015)

    OAuth 1 & 2 provider API refactor with breaking changes:

    • All endpoint methods change contract to return 3 values instead of 4. The new signature is headers, body, status code where the initial redirect_uri has been relocated to its rightful place inside headers as Location.
    • OAuth 1 Access Token Endpoint has a new required validator method invalidate_request_token.
    • OAuth 1 Authorization Endpoint now returns a 200 response instead of 302 on oob callbacks.
    Source code(tar.gz)
    Source code(zip)
Owner
OAuthlib
OAuthlib
GitHub
Python library for generating a Mastercard API compliant OAuth signature.

oauth1-signer-python Table of Contents Overview Compatibility References Usage Prerequisites Adding the Library to Your Project Importing the Code Loa

null 23 Aug 1, 2022
The ultimate Python library in building OAuth, OpenID Connect clients and servers. JWS,JWE,JWK,JWA,JWT included.

Authlib The ultimate Python library in building OAuth and OpenID Connect servers. JWS, JWK, JWA, JWT are included. Authlib is compatible with Python2.

Hsiaoming Yang 3.4k Jan 4, 2023
A fully tested, abstract interface to creating OAuth clients and servers.

Note: This library implements OAuth 1.0 and not OAuth 2.0. Overview python-oauth2 is a python oauth library fully compatible with python versions: 2.6

Joe Stump 3k Jan 2, 2023
Doing the OAuth dance with style using Flask, requests, and oauthlib.

Flask-Dance Doing the OAuth dance with style using Flask, requests, and oauthlib. Currently, only OAuth consumers are supported, but this project coul

David Baumgold 915 Dec 28, 2022
Toolkit for Pyramid, a Pylons Project, to add Authentication and Authorization using Velruse (OAuth) and/or a local database, CSRF, ReCaptcha, Sessions, Flash messages and I18N

Apex Authentication, Form Library, I18N/L10N, Flash Message Template (not associated with Pyramid, a Pylons project) Uses alchemy Authentication Authe

null 95 Nov 28, 2022
This is a Python library for accessing resources protected by OAuth 2.0.

This is a client library for accessing resources protected by OAuth 2.0. Note: oauth2client is now deprecated. No more features will be added to the l

Google APIs 787 Dec 13, 2022
A Python library for OAuth 1.0/a, 2.0, and Ofly.

Rauth A simple Python OAuth 1.0/a, OAuth 2.0, and Ofly consumer library built on top of Requests. Features Supports OAuth 1.0/a, 2.0 and Ofly Service

litl 1.6k Dec 8, 2022
The ultimate Python library in building OAuth, OpenID Connect clients and servers. JWS,JWE,JWK,JWA,JWT included.

Authlib The ultimate Python library in building OAuth and OpenID Connect servers. JWS, JWK, JWA, JWT are included. Authlib is compatible with Python2.

Hsiaoming Yang 2.3k Feb 17, 2021
Doing the OAuth dance with style using Flask, requests, and oauthlib.

Flask-Dance Doing the OAuth dance with style using Flask, requests, and oauthlib. Currently, only OAuth consumers are supported, but this project coul

David Baumgold 799 Feb 17, 2021
Doing the OAuth dance with style using Flask, requests, and oauthlib.

Flask-Dance Doing the OAuth dance with style using Flask, requests, and oauthlib. Currently, only OAuth consumers are supported, but this project coul

David Baumgold 802 Feb 22, 2021
Phishing Abusing Microsoft 365 OAuth Authorization Flow

Microsoft365_devicePhish Abusing Microsoft 365 OAuth Authorization Flow for Phishing Attack This is a simple proof-of-concept script that allows an at

bigb0ss 11 Dec 11, 2022
Abusing Microsoft 365 OAuth Authorization Flow for Phishing Attack

Microsoft365_devicePhish Abusing Microsoft 365 OAuth Authorization Flow for Phishing Attack This is a simple proof-of-concept script that allows an at

Optiv Security 76 Jan 2, 2023
Local server that gives you your OAuth 2.0 tokens needed to interact with the Conta Azul's API

What's this? This is a django project meant to be run locally that gives you your OAuth 2.0 tokens needed to interact with Conta Azul's API Prerequisi

Fábio David Freitas 3 Apr 13, 2022
A module making it easier to manage Discord oAuth with Quart

quart_discord A module making it easier to manage Discord oAuth with Quart Install pip install git+https://github.com/xelA/quart_discord@master How to

null 5 Oct 27, 2022
Plotly Dash plugin to allow authentication through 3rd party OAuth providers.

dash-auth-external Integrate your dashboards with 3rd parties and external OAuth providers. Overview Do you want to build a Plotly Dash app which pull

James Holcombe 15 Dec 11, 2022
A full Rest-API With Oauth2 and JWT for request & response a JSON file Using FastAPI and SQLAlchemy 🔑

Pexon-Rest-API A full Rest-API for request & response a JSON file, Building a Simple WorkFlow that help you to Request a JSON File Format and Handling

Yasser Tahiri 15 Jul 22, 2022
JSON Web Token implementation in Python

PyJWT A Python implementation of RFC 7519. Original implementation was written by @progrium. Sponsor If you want to quickly add secure token-based aut

José Padilla 4.5k Jan 9, 2023
A JOSE implementation in Python

python-jose A JOSE implementation in Python Docs are available on ReadTheDocs. The JavaScript Object Signing and Encryption (JOSE) technologies - JSON

Michael Davis 1.2k Dec 28, 2022
Implementation of Supervised Contrastive Learning with AMP, EMA, SWA, and many other tricks

SupCon-Framework The repo is an implementation of Supervised Contrastive Learning. It's based on another implementation, but with several differencies

Ivan Panshin 132 Dec 14, 2022