py2http.middleware

aiohttp middleware that guards every route of an app: mk_jwt_middleware (a verified Authorization: Bearer JWT) and mk_superadmin_middleware (one shared key). The checks themselves live in py2http.auth, shared with the Bottle plugins of py2http.bottle_plugins.

Functions

mk_jwt_middleware(secret[, verify, ...])	Make an aiohttp middleware that requires a valid Authorization: Bearer JWT on every request, and puts the decoded claims on request.token.
mk_superadmin_middleware(secret)	Make an aiohttp middleware that only lets through requests whose Authorization header is exactly secret (compared in constant time).

py2http.middleware.mk_jwt_middleware(secret, verify=True, *, algorithms=('HS256',), public_routes=('ping', 'openapi'), allow_mixed_algorithm_families=False, decode_kwargs=None)

Make an aiohttp middleware that requires a valid Authorization: Bearer JWT on every request, and puts the decoded claims on request.token.

Parameters:

• secret – The key tokens are verified with (an HMAC secret for HS* algorithms, a public key for RS*/ES*/…).

• verify – If False, signatures and claims (exp, …) are NOT checked: whatever a token says ends up on request.token, and an undecodable token only triggers a warning. For development only. (Before, PyJWT 2 ignored the legacy option this passed, so signatures were still checked even with verify=False.)

• algorithms (Iterable[str]) – The algorithms a token may be signed with (PyJWT names, case-sensitive; "none" is refused). Defaults to ("HS256",), as py2http.bottle_plugins.JWTPlugin does.

• public_routes (Iterable[str]) – Names of aiohttp routes (name= in add_route) that need no token. Matched on the route name, not the handler’s __name__, so a handler that happens to be called ping is not public by accident. Route names are matched in sub-applications too, so a sub-app route named ping is public as well.

• allow_mixed_algorithm_families (bool) – Accepting an HMAC algorithm and a public-key algorithm with one secret is the classic algorithm-confusion setup (a token “signed” with HS256 using the public key as the HMAC secret), so it raises ValueError unless this is True. The middleware used to accept ["HS256", "RS256"]; pass that list with this flag to restore it.

• decode_kwargs (dict) – Extra jwt.decode arguments, such as audience, issuer or leeway (without them a token carrying an aud claim is always refused).

py2http.middleware.mk_superadmin_middleware(secret)

Make an aiohttp middleware that only lets through requests whose Authorization header is exactly secret (compared in constant time). An empty secret is refused, since it would let header-less requests through.