Obtain SSL client certificate from FastAPI request

[jbakermk]

First Check

• I added a very descriptive title to this issue.
• I used the GitHub search to find a similar issue and didn't find it.
• I searched the FastAPI documentation, with the integrated search.
• I already searched in Google "How to X in FastAPI" and didn't find any information.
• I already read and followed all the tutorial in the docs and didn't find an answer.
• I already checked if it is not related to FastAPI but to Pydantic.
• I already checked if it is not related to FastAPI but to Swagger UI.
• I already checked if it is not related to FastAPI but to ReDoc.

Commit to Help

• I commit to help with one of those options 👆

Example Code

@app.get("/")
async def get_root(request:Request):
  # how do I obtain the DN from the SSL client cert?
  return "hello"

Description

uvicorn provides the SSL front end and manages client certificates, i.e.

uvicorn.run(
  "main:app", host="0.0.0.0", port=8443,
  ssl_cert_reqs=2, 
  ssl_ca_cert="/path/to/certs.cert",
  ssl_keyfile="/path/to/keyfile", 
  ssl_certfile="/path/to/certfile"
)

But there appears to be no way to extract the Distinguised Name from the client certifcate within FastAPI, which I assume means uvicorn does not pass it.

Operating System

Linux

Operating System Details

Ubuntu, but any.

FastAPI Version

0.79.0

Python Version

3.7

Additional Context

uvicorn 0.18.2.

[jbakermk]

I've made some progress. Reading this:

Kludex/uvicorn#400

I assume the issue sits with uvicorn, not exposing the cert. This monkeypatch works:

from uvicorn.protocols.http.httptools_impl import HttpToolsProtocol
old_on_url = HttpToolsProtocol.on_url
def new_on_url(self,url):
    old_on_url(self, url)
    self.scope['transport'] = self.transport
HttpToolsProtocol.on_url = new_on_url

Which allows the subject DN to be retrieved as follows:

@app.get("/")
async def get_root(request:Request):
  t= request.scope["transport"].get_extra_info("ssl_object").getpeercert()["subject"]

and t is a tuple of data, which is a litltle tedious to parse but better than nothing.

It's both a brilliant and horrible hack - is there a better way? :)