pyramid-csrf-multi-scheme 1.0.0__py2.py3-none-any.whl

pyramid_csrf_multi_scheme/__init__.py

@@ -0,0 +1,189 @@
+# stdlib
+import sys
+import uuid
+
+# pypi
+from pyramid.interfaces import ICSRFStoragePolicy
+from pyramid.request import Request
+from pyramid.util import strings_differ
+from pyramid.util import SimpleSerializer
+from webob.cookies import CookieProfile
+from webob.response import Response
+from zope.interface import implementer
+
+
+# ==============================================================================
+
+
+__VERSION__ = "1.0.0"
+
+
+# ------------------------------------------------------------------------------
+
+
+"""
+The following functions are taken from Pyramid directly.
+
+* `pyramid.compat.bytes_`
+* `pyramid.compat.text_`
+"""
+
+text_type = unicode if (sys.version_info[0] == 2) else str
+binary_type = str if (sys.version_info[0] == 2) else bytes
+
+
+def text_(s, encoding="latin-1", errors="strict"):
+    """If ``s`` is an instance of ``binary_type``, return
+    ``s.decode(encoding, errors)``, otherwise return ``s``"""
+    if isinstance(s, binary_type):
+        return s.decode(encoding, errors)
+    return s
+
+
+def bytes_(s, encoding="latin-1", errors="strict"):
+    """If ``s`` is an instance of ``text_type``, return
+    ``s.encode(encoding, errors)``, otherwise return ``s``"""
+    if isinstance(s, text_type):
+        return s.encode(encoding, errors)
+    return s
+
+
+# ==============================================================================
+
+
+@implementer(ICSRFStoragePolicy)
+class DualCookieCSRFStoragePolicy(object):
+    """
+    A re-implementation of ``pyramid.csrf.CookieCSRFStoragePolicy``.
+    This policy runs separate csrf tokens on http and https connections.
+
+    If the connection is https:
+        expiring the csrf will expire the http and https
+        only the https csrf will be consulted
+
+    If the connection is http:
+        expiring the csrf will expire the http
+        only the http csrf will be consulted
+
+    last synced to pyramid: 1.10.4
+
+    NOTE: this does not support a ``secure`` argument
+    """
+
+    _token_factory = staticmethod(lambda: text_(uuid.uuid4().hex))
+
+    def __init__(
+        self,
+        cookie_name_secure="csrf_https",
+        cookie_name_http="csrf_http",
+        secure=None,
+        httponly=False,
+        domain=None,
+        max_age=None,
+        path="/",
+        samesite="Lax",
+    ):
+        if secure is not None:
+            raise ValueError(
+                "`DualCookieCSRFStoragePolicy` does not support "
+                "the `secure` argument."
+            )
+        serializer = SimpleSerializer()
+        self.cookie_name_secure = cookie_name_secure
+        self.cookie_name_http = cookie_name_http
+        self.cookie_profile_secure = CookieProfile(
+            cookie_name=cookie_name_secure,
+            secure=True,
+            max_age=max_age,
+            httponly=httponly,
+            path=path,
+            domains=[domain],
+            serializer=serializer,
+            samesite=samesite,
+        )
+        self.cookie_profile_http = CookieProfile(
+            cookie_name=cookie_name_http,
+            secure=False,
+            max_age=max_age,
+            httponly=httponly,
+            path=path,
+            domains=[domain],
+            serializer=serializer,
+            samesite=samesite,
+        )
+
+    @property
+    def cookie_profile(self):
+        """
+        Returns the active cookie profile for the request's scheme.
+        """
+        raise ValueError(
+            "`DualCookieCSRFStoragePolicy` supports access "
+            "via the attributes `.cookie_profile_secure` and "
+            "via the attributes `.cookie_profile_http`. The "
+            "attribute `.cookie_profile` is not supported."
+        )
+
+    def new_csrf_token(self, request):
+        # type: (Request) -> str
+        """Rotate the HTTP token and also the HTTPS token on secure requests."""
+
+        def _issue_token(cookie_name, profile):
+            # type: (str, CookieProfile) -> str
+            """Store a fresh token and schedule its response cookie."""
+            token = self._token_factory()
+            request.cookies[cookie_name] = token
+
+            def _set_cookie(request, response):
+                # type: (Request, Response) -> None
+                profile.set_cookies(response, token)
+
+            request.add_response_callback(_set_cookie)
+            return token
+
+        token_http = _issue_token(self.cookie_name_http, self.cookie_profile_http)
+        if request.scheme == "https":
+            return _issue_token(self.cookie_name_secure, self.cookie_profile_secure)
+        return token_http
+
+    def get_csrf_token(self, request):
+        """
+        Returns the currently active CSRF token by checking the cookies
+        sent with the current request.
+        """
+        if request.scheme == "https":
+            # only consult the secure cookie
+            bound_cookies = self.cookie_profile_secure.bind(request)
+        else:
+            # the only accessible cookie is http insecure
+            bound_cookies = self.cookie_profile_http.bind(request)
+        token = bound_cookies.get_value()
+        if not token:
+            token = self.new_csrf_token(request)
+        return token
+
+    def check_csrf_token(self, request, supplied_token):
+        # type: (Request, object) -> bool
+        """Check a text or byte token using Pyramid's timing-safe comparison."""
+        if not isinstance(supplied_token, (text_type, binary_type)):
+            return False
+        try:
+            supplied_bytes = bytes_(supplied_token)
+        except UnicodeEncodeError:
+            return False
+        expected_token = self.get_csrf_token(request)
+        return not strings_differ(bytes_(expected_token), supplied_bytes)
+
+    def get_csrf_token_scheme(self, request, scheme):
+        """this is a utility for testing"""
+        if scheme not in ("https", "http"):
+            raise ValueError("unknown scheme")
+        if scheme == "https":
+            if request.scheme != "https":
+                return None
+            bound_cookies = self.cookie_profile_secure.bind(request)
+            token = bound_cookies.get_value()
+            return token
+        bound_cookies = self.cookie_profile_http.bind(request)
+        token = bound_cookies.get_value()
+        return token

pyramid_csrf_multi_scheme/debugtoolbar/__init__.py

@@ -0,0 +1,8 @@
+from .panels.csrf_multi_scheme import CSRFMultiSchemeDebugPanel
+
+
+def includeme(config):
+    """
+    Pyramid API hook
+    """
+    config.add_debugtoolbar_panel(CSRFMultiSchemeDebugPanel)

pyramid_csrf_multi_scheme/debugtoolbar/panels/csrf_multi_scheme.py

@@ -0,0 +1,116 @@
+from pyramid_debugtoolbar.panels import DebugPanel
+
+from pyramid.interfaces import ICSRFStoragePolicy
+from ... import DualCookieCSRFStoragePolicy
+
+_ = lambda x: x
+
+
+class CSRFMultiSchemeDebugPanel(DebugPanel):
+    """
+    Sample debug panel
+    """
+
+    name = "CSRFMultiScheme"
+    has_content = None
+    template = "pyramid_csrf_multi_scheme.debugtoolbar.panels:templates/csrf_multi_scheme.dbtmako"
+
+    # only query the policy once
+    _policy = None
+
+    # stash
+    _cookie_names = None
+
+    response = None  # we may never have a response
+
+    def __init__(self, request):
+
+        self.data = {
+            "request_data": {
+                "cookie_secure": {"in": None, "out": None, "cookie_name": None},
+                "cookie_http": {"in": None, "out": None, "cookie_name": None},
+            }
+        }
+        policy = request.registry.queryUtility(ICSRFStoragePolicy)
+        if isinstance(policy, DualCookieCSRFStoragePolicy):
+            self._policy = policy
+            self._cookie_names = [policy.cookie_name_secure, policy.cookie_name_http]
+
+            self.has_content = True
+
+            self.data["request_data"]["cookie_secure"]["in"] = request.cookies.get(
+                policy.cookie_name_secure
+            )
+            self.data["request_data"]["cookie_secure"][
+                "cookie_name"
+            ] = policy.cookie_name_secure
+
+            self.data["request_data"]["cookie_http"]["in"] = request.cookies.get(
+                policy.cookie_name_http
+            )
+            self.data["request_data"]["cookie_http"][
+                "cookie_name"
+            ] = policy.cookie_name_http
+
+            # `process_response` fires before the set_cookie callbacks, so use this hack...
+            def finished_callback(request):
+                self._process_response_deferred()
+
+            request.add_finished_callback(finished_callback)
+
+    def process_response(self, response):
+        """`
+        process_response` fires before the set_cookie callbacks
+        so we use a hack from pyramid_debugtoolbar's HeaderDebugPanel
+
+        1. `__init__()` sets a callback to `_process_response_deferred()`
+        2. `process_response()` stashes the response
+        3. `_process_response_deferred` has the headers
+        """
+        self.response = response
+
+    def _process_response_deferred(self):
+        """
+        `process_response` fires before the set_cookie callbacks
+        so we use a hack from pyramid_debugtoolbar's HeaderDebugPanel
+        """
+        if self.response is not None:
+            cookies = [i for i in self.response.headerlist if i[0] == "Set-Cookie"]
+            # [('Set-Cookie', 'ci_ss_ck=eXrTEtumW4Jal3FyEXtkJijofCAyOnayzGQiPG7IAjukycfE; Domain=.dev.example.com; Path=/'),
+            #  ('Set-Cookie', 'ci_s_ck=iG6dqE5mff_iR2Y95o5eENuVdC; Domain=.dev.example.com; Path=/')
+            #  ]
+            for ck in cookies:
+                try:
+                    ck_parts = ck[1].split(";")
+                    (ck_name, ck_value) = ck_parts[0].split(
+                        "=", 1
+                    )  # maxsplit 1, because the value could be an encoding with == as a right pad
+                    if ck_name in self._cookie_names:
+                        if (
+                            ck_name
+                            == self.data["request_data"]["cookie_secure"]["cookie_name"]
+                        ):
+                            self.data["request_data"]["cookie_secure"]["out"] = ck_value
+                        elif (
+                            ck_name
+                            == self.data["request_data"]["cookie_http"]["cookie_name"]
+                        ):
+                            self.data["request_data"]["cookie_http"]["out"] = ck_value
+                except Exception as exc:
+                    # TODO: logging
+                    pass
+
+    @property
+    def nav_title(self):
+        return _(self.name)
+
+    @property
+    def title(self):
+        return _(self.name)
+
+    @property
+    def url(self):
+        return ""
+
+    def render_content(self, request):
+        return DebugPanel.render_content(self, request)

pyramid_csrf_multi_scheme/debugtoolbar/panels/templates/csrf_multi_scheme.dbtmako

@@ -0,0 +1,34 @@
+<%!
+	def coded_value(val):
+		if val:
+			return "<code>%s</code>" % val
+		return ''
+%>
+
+<table class="table table-striped table-condensed">
+	<thead>
+		<tr>
+			<th>cookie_type</th>
+			<th>cookie_secure</th>
+			<th>cookie_http</th>
+		</tr>
+	</thead>
+	<tbody>
+		<tr>
+			<th>cookie_name</th>
+			<td><code>${request_data['cookie_secure']['cookie_name']}</code></td>
+			<td><code>${request_data['cookie_http']['cookie_name']}</code></td>
+		</tr>
+		<tr>
+			<th>request</th>
+			<td>${coded_value(request_data['cookie_secure']['in'])|n}</td>
+			<td>${coded_value(request_data['cookie_http']['in'])|n}</td>
+		</tr>
+		<tr>
+			<th>response</th>
+			<td>${coded_value(request_data['cookie_secure']['out'])|n}</td>
+			<td>${coded_value(request_data['cookie_http']['out'])|n}</td>
+		</tr>
+	</tbody>
+</table>
+

pyramid_csrf_multi_scheme-1.0.0.dist-info/METADATA

@@ -0,0 +1,110 @@
+Metadata-Version: 2.4
+Name: pyramid_csrf_multi_scheme
+Version: 1.0.0
+Summary: Provides for creating independent csrf tokens for the http and https schemes
+Home-page: https://github.com/jvanasco/pyramid_csrf_multi_scheme
+Author: Jonathan Vanasco
+Author-email: jvanasco@2xlp.com
+License: BSD-derived (http://www.repoze.org/LICENSE.txt)
+Keywords: web,pyramid,csrf
+Classifier: Intended Audience :: Developers
+Classifier: Framework :: Pyramid
+Classifier: Programming Language :: Python :: 2.7
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.5
+Classifier: Programming Language :: Python :: 3.6
+Classifier: Programming Language :: Python :: 3.7
+Classifier: Programming Language :: Python :: 3.8
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3.15
+Requires-Python: !=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,>=2.7
+Description-Content-Type: text/x-rst
+License-File: LICENSE.txt
+Requires-Dist: pyramid>=1.10.4
+Requires-Dist: setuptools<82; python_version >= "3.7" and python_version < "3.10"
+Provides-Extra: testing
+Requires-Dist: coverage; extra == "testing"
+Requires-Dist: pytest; extra == "testing"
+Requires-Dist: pyramid_debugtoolbar>=4.0.0; extra == "testing"
+Dynamic: license-file
+
+pyramid_csrf_multi_scheme
+=========================
+
+.. image:: https://github.com/jvanasco/pyramid_csrf_multi_scheme/workflows/Python%20package/badge.svg
+        :alt: Build Status
+
+This package enables two separate cookie tokens on each request, bound to the scheme:
+
+* a SECURE HTTPS only cookie
+* a mixed-use insecure http token (which is also available on https).
+
+If the current scheme is `HTTPS`:
+
+* only the SECURE HTTPS token will be considered
+* HOWEVER calls to generate a new token will reset both the SECURE HTTPS and the
+  insecure http tokens.
+
+If the current scheme is `insecure http`:
+
+* the SECURE HTTPS tokens are ignored as they are not even available, and only the
+  insecure http token is considered.
+
+
+Python Versions
+---------------
+
+This package is currently supported under Python2.7 and 3.8; other 3.x versions may work.
+
+This package should work on Pyramid1.x and 2.x
+
+
+Why?
+----
+
+If an application supports both `HTTP` and `HTTPS` endpoints, this package simplifies
+isolating the CSRF data from both.
+
+
+Is this necessary?
+------------------
+
+I'm not sure, but have decided to err on the side of caution.
+
+HTTP traffic is sent in plaintext and capable of being intercepted by a
+man-in-the-middle or network packet sniffing.
+
+It seems plausible that someone might read a csrf token via HTTP and use that
+in attempts to compromise HTTPS endpoints in a mixed use environment.
+
+A better option is to only use HTTPS tokens and forms - but that is not
+always an option.
+
+
+debugtoolbar support!
+---------------------
+
+just add to your `ENVIRONMENT.ini` file, or similar application configuration.
+
+.. code-block:: python
+
+    debugtoolbar.includes = pyramid_csrf_multi_scheme.debugtoolbar
+
+Tthe debugtoolbar will now have a `CSRFMultiScheme` panel that has the following info:
+
+* configuration info on the cookie names
+* incoming request csrf values
+* outgoing response csrf values
+
+
+License
+-------
+
+Most of this is just code lightly edited from Pyramid, and
+therefore available under Pyramid's licensing terms.
+

pyramid_csrf_multi_scheme-1.0.0.dist-info/RECORD

@@ -0,0 +1,10 @@
+pyramid_csrf_multi_scheme/__init__.py,sha256=hg1nrVe51ZXv23T0RsnrgxHSfUGMpr9tsomMDrUUOjg,6187
+pyramid_csrf_multi_scheme/debugtoolbar/__init__.py,sha256=y-09Tp_6atpkVbdJKYlXBRNJU5Id0H9S1GyLWkASj1E,187
+pyramid_csrf_multi_scheme/debugtoolbar/panels/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+pyramid_csrf_multi_scheme/debugtoolbar/panels/csrf_multi_scheme.py,sha256=V8vP7emxqTWwJ8WrNVjzpmRdTVMRMsRoSvZWeZ-SCDI,4130
+pyramid_csrf_multi_scheme/debugtoolbar/panels/templates/csrf_multi_scheme.dbtmako,sha256=LHQSj8Sfv57fEpVkp-e1eTlZY6w3k9NOW72Mz1x0KLk,792
+pyramid_csrf_multi_scheme-1.0.0.dist-info/licenses/LICENSE.txt,sha256=GiTI_rOhwQPIHLvhwbVxVrBcpi3Q-9vC0iqWjPHJeXE,1850
+pyramid_csrf_multi_scheme-1.0.0.dist-info/METADATA,sha256=RmCVoxDd1Qv0jolfidWruZfsC-jXAvI20n4e-5Wj414,3562
+pyramid_csrf_multi_scheme-1.0.0.dist-info/WHEEL,sha256=Uvlg2aNlEKdilsyFSJt1QX5me0eEbCjQzR3nZeFkvy4,109
+pyramid_csrf_multi_scheme-1.0.0.dist-info/top_level.txt,sha256=B88icNON_eQZtw45b_Ajo1m5Xos3YgI6WC-QNLoMB8w,26
+pyramid_csrf_multi_scheme-1.0.0.dist-info/RECORD,,

pyramid_csrf_multi_scheme-1.0.0.dist-info/WHEEL

@@ -0,0 +1,6 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.2.1)
+Root-Is-Purelib: true
+Tag: py2-none-any
+Tag: py3-none-any
+

pyramid_csrf_multi_scheme-1.0.0.dist-info/licenses/LICENSE.txt

@@ -0,0 +1,40 @@
+The majority of the code in Pyramid is supplied under this license:
+
+  A copyright notice accompanies this license document that identifies
+  the copyright holders.
+
+  Redistribution and use in source and binary forms, with or without
+  modification, are permitted provided that the following conditions are
+  met:
+
+  1.  Redistributions in source code must retain the accompanying
+      copyright notice, this list of conditions, and the following
+      disclaimer.
+
+  2.  Redistributions in binary form must reproduce the accompanying
+      copyright notice, this list of conditions, and the following
+      disclaimer in the documentation and/or other materials provided
+      with the distribution.
+
+  3.  Names of the copyright holders must not be used to endorse or
+      promote products derived from this software without prior
+      written permission from the copyright holders.
+
+  4.  If any files are modified, you must cause the modified files to
+      carry prominent notices stating that you changed the files and
+      the date of any change.
+
+  Disclaimer
+
+    THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND
+    ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+    TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+    PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+    HOLDERS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+    EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+    TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+    DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+    ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+    TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+    THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+    SUCH DAMAGE.

pyramid_csrf_multi_scheme-1.0.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+pyramid_csrf_multi_scheme