Implementing auth handlers with `aiohttp.client`

[alexdutton]

Is there a preferred way to hook in auth handlers to the HTTP client? If not, can we specify one, maybe with code changes to ClientSession to support it?

[asvetlov]

I don't follow. What do you want to do with auth?

[alexdutton]

Implement e.g. OAuth, Negotiate, Digest auth on the client side, instead of just supporting Basic.

More generally, have some way of hooking in error handlers for 4xx responses that can perform additional requests before returning a response. Could also be used to transparently back off on 420 and 429 responses.

[alexdutton]

My thinking was putting something near the bottom of the while True loop in ClientSession.request to allow something to be hooked in to handle 4xx (or any other) status by manipulating the request and performing it again. Nowhere near sure on the details yet though.

[alunduil]

Custom authentication mechanisms in requests would be awesome. Right now it looks like I have to subclass the ClientRequest and overload update_auth to perform my custom authentication logic.

If we simply didn't have the expectation that an auth was a BasicAuth but something that responded to an encode method (or something similar) that would be awesome. I'd also really like it if the request itself could be available for the encoding process for mechanisms that want to have a signature of the request itself.

[mattpepin]

Any progress on this one? Digest auth is often needed to interface with IoT devices/IP cameras.

[fafhrd91]

PR would be awesome. Personally, I don't have time for this

[fidiego]

Would this be a good place to mention I'd like to add support for AWS4Auth?

[dadocsis]

I have a use case for ntlm auth

[dadocsis]

Would it make sense to add event hooks similar to the requests package?
http://docs.python-requests.org/en/master/user/advanced/#event-hooks
This could allow devs to register custom authentication methods.

IE:

class MyAuth:
      async def do_custom_auth(self, response):
            if r.status_code == 401:                  
                  # do custom

      def __call__(self, request):
            request.register_hook('response', do_custom_auth)

[fidiego]

That would be very cool.

…

On Fri, Dec 1, 2017 at 8:25 AM, dadocsis ***@***.***> wrote: Would it make sense to add event hooks similar to the requests package? http://docs.python-requests.org/en/master/user/advanced/#event-hooks This could allow devs to register custom authentication methods. IE: ` class MyAuth: async def do_custom_auth(self, response): if r.status_code == 401: # do some custom auth def __call__(self, request): request.register_hook('response', do_custom_auth) ` — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#434 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AClF3K2xBosTHiayvQqEdRyGxdqOBnfaks5s7_4ygaJpZM4FVGp6> .

[sky-code]

maybe just add before_send hook as last point where request can be changed so by using one hook we can inject auth headers before send request ?

[asvetlov]

Public client request object is not exist (yet).

[RobertoPrevato]

I was just digging into a similar topic in the last days: OpenID Connect, OAuth2, validation of JWT issued by Azure B2C in Python, I made a working setup for servers (will share my code when I have time to clean it up).

I think aiohttp.client and ClientSession should not support more options for auth, or support handling of specific response codes (like 401, 403); these classes must be abstracted from specific auth scenarios: they already have lots to do, just to be good HTTP clients and client sessions.

In fact, I think that including support for basic auth in the constructor of ClientSession was a mistake in the first place. There are just too many scenarios: should the client support automatic login using Client Credentials flow, by client id and secret? Or maybe automatic handling of refresh_tokens to fetch new access_tokens when using Authorization code grant?

I think these things should be placed in dedicated libraries, outside of aiohttp.