Skip to content

HMACAuth broken in python 3 #19

@bs610

Description

@bs610

Python 3's change of string behaviour has affected the HMACAuth class. Two changes are required in auth.py:

  1. Return a string from get_signature() instead of bytes. Without this, the call to format() results in a string like SRS:key:b'sig' instead of SRS:key:sig, and eventually you get a 401 Unauthorized:
@@ -35,7 +35,7 @@ class HMACAuth(AuthBase):
     def get_signature(self, r):
         canonical_string = self.get_canonical_string(r.url, r.headers, r.method)
         h = hmac.new(self.secret_key, canonical_string, digestmod=hashlib.sha1)
-        return base64.encodestring(h.digest()).strip()
+        return base64.encodestring(h.digest()).strip().decode('utf-8')

     def get_canonical_string(self, url, headers, method):
         parsedurl = urlparse(url)
  1. Encode the output of get_canonical_string(). Without this, hmac.new() complains that unicode objects need to be encoded before hashing:
@@ -54,7 +54,7 @@ class HMACAuth(AuthBase):
         content_type = d_headers['content-type'] if 'content-type' in d_headers else ""
         date = d_headers['date']
         hash_buf = "%s\n%s\n%s\n%s\n%s\n" % (method, rpath, content_md5, content_type, date)
-        return hash_buf
+        return hash_buf.encode('utf-8')


 """

I have tested that these changes fix my auth problems in Python 3.6, and do not affect the behaviour in Python 2.7.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions