Offensive Security Researcher & Quantum Cryptography Analyst

HTTP different authentications with a request module in python

Abdul Wahab Junaid
HTTP different authentications with a request module in python

HTTP Basic Authentication, HTTP Digest Authentication, and HTTP Bearer Authentication are three common authentication mechanisms used in the HTTP protocol, each with its own characteristics and security considerations.

1. HTTP Basic Authentication:

2. HTTP Digest Authentication:

3. HTTP Bearer Authentication:

Summary:

When choosing an authentication mechanism, consider the security requirements of your application and whether you are working with legacy systems or modern APIs. Always use HTTPS to secure the communication channel.

HTTP Basic Authentication with Python

HTTP Basic Authentication to make a request to the GitHub API.

Importing Required Modules

Python
#!/usr/bin/env python3

import requests
from requests.auth import HTTPBasicAuth
from getpass import getpass

Getting User Input for Credentials

Python
username = input("Enter username:")
password = getpass()

Making a Request to GitHub API with HTTP Basic Authentication

Python
response = requests.get('https://api.github.com/user', auth=HTTPBasicAuth(username, password))

Handling the Response

Python
print('Response.status_code:' + str(response.status_code))

if response.status_code == 200:
    print('Login successful: ' + response.text)
Python
#!/usr/bin/env python3

import requests
from requests.auth import HTTPBasicAuth
from getpass import getpass

username=input("Enter username:")
password = getpass()

response = requests.get('https://api.github.com/user', auth=HTTPBasicAuth(username,password))
print('Response.status_code:'+ str(response.status_code))

if response.status_code == 200:
    print('Login successful :'+response.text)

The code demonstrates a simple command-line program where the user enters their GitHub username and password securely. It then uses HTTP Basic Authentication to make a request to the GitHub API endpoint for user information. The response status code and, if successful, the response content are printed. The use of getpass ensures that the password is not echoed to the terminal for security reasons.

HTTP Digest Authentication with Python

HTTP Digest Authentication to make a request to a protected endpoint using the requests library.

Importing Required Modules

Python
#!/usr/bin/env python3

import requests
from requests.auth import HTTPDigestAuth
from getpass import getpass

Getting User Input for Credentials

Python
user = input("Enter user:")
password = getpass()

Making a Request to a URL with HTTP Digest Authentication

Python
url = 'http://httpbin.org/digest-auth/auth/user/pass'
response = requests.get(url, auth=HTTPDigestAuth(user, password))

Printing Request Headers

Python
print("Headers request : ")
for header, value in response.request.headers.items():
    print(header, '-->', value)

Handling the Response

Python
print('Response.status_code:' + str(response.status_code))
if response.status_code == 200:
    print('Login successful: ' + str(response.json()))

    print("Headers response: ")
    for header, value in response.headers.items():
        print(header, '-->', value)
Python
#!/usr/bin/env python3

import requests
from requests.auth import HTTPDigestAuth
from getpass import getpass

user=input("Enter user:")
password = getpass()

url = 'http://httpbin.org/digest-auth/auth/user/pass'
response = requests.get(url, auth=HTTPDigestAuth(user, password))

print("Headers request : ")
for header, value in response.request.headers.items():
  print(header, '-->', value)

print('Response.status_code:'+ str(response.status_code))
if response.status_code == 200:
    print('Login successful :'+str(response.json()))

    print("Headers response: ")
    for header, value in response.headers.items():
        print(header, '-->', value)

The code demonstrates a simple command-line program where the user enters their username and password securely. It then uses HTTP Digest Authentication to make a request to a protected endpoint ('http://httpbin.org/digest-auth/auth/user/pass'). The response status code, response content, and response headers are printed. The use of getpass ensures that the password is not echoed to the terminal for security reasons.

Authentication mechanisms in Python can vary depending on the type of authentication required by the service or application you are interacting with. Here, I’ll cover several common authentication mechanisms and how to implement them in Python.

1. HTTP Basic Authentication:

Python
import requests
from requests.auth import HTTPBasicAuth

url = "https://api.example.com/resource"
username = "your_username"
password = "your_password"

response = requests.get(url, auth=HTTPBasicAuth(username, password))
print(response.text)

2. Token-based Authentication:

Python
import requests

url = "https://api.example.com/resource"
token = "your_access_token"

headers = {"Authorization": f"Bearer {token}"}
response = requests.get(url, headers=headers)
print(response.text)

3. OAuth 2.0 Authentication:

For OAuth 2.0, you typically use a library like requests_oauthlib or authlib.

Python
from requests_oauthlib import OAuth2Session

client_id = "your_client_id"
client_secret = "your_client_secret"
redirect_uri = "your_redirect_uri"
authorization_base_url = "https://example.com/oauth/authorize"
token_url = "https://example.com/oauth/token"

oauth = OAuth2Session(client_id, redirect_uri=redirect_uri)
authorization_url, _ = oauth.authorization_url(authorization_base_url)

print(f"Please go to {authorization_url} and authorize access.")
redirect_response = input("Paste the full redirect URL here: ")

oauth.fetch_token(token_url, authorization_response=redirect_response, client_secret=client_secret)

# Now you can make authenticated requests
url = "https://api.example.com/resource"
response = oauth.get(url)
print(response.text)

4. API Key Authentication:

Python
import requests

url = "https://api.example.com/resource"
api_key = "your_api_key"

headers = {"API-Key": api_key}
response = requests.get(url, headers=headers)
print(response.text)

5. JWT (JSON Web Token) Authentication:

Python
import requests
import jwt

url = "https://api.example.com/resource"
private_key = "your_private_key"

# Create a JWT token
token = jwt.encode({"some_claim": "some_value"}, private_key, algorithm="RS256")

headers = {"Authorization": f"Bearer {token}"}
response = requests.get(url, headers=headers)
print(response.text)

Choose the authentication mechanism based on the requirements of the service or API you are interacting with. Always follow best practices for securing sensitive information, such as using environment variables to store credentials.

Exit mobile version