Add authentication headers to HTTP requests when IRI node is running with `--remote-auth`

[HerrMuellerluedenscheid]

Hi again,

I saw the same question unanswered on reddit , so I thought I approach you directly. How can I connect to my full node when --remote-auth is active? I searched through the code but couldn't get the point. Is it not yet implemented or 'hidden' in a wrapping call? If it is not implemented and I wanted to give it a shot, where would I have to start digging into the code? My first naive guess would be to extend the BaseCommand.

Greetings from Potsdam

Marius

PS.: I asked on slack as well but didn't get a response, yet. And also others might sooner or later have the same question.

[HerrMuellerluedenscheid]

Thanks to @nuriel77 I was able to use remote authentication by modifying the http headers of the http adapter. Here are the essentials:

from base64 import b64encode

adapter = HttpAdapter(
  uri = u'http://localhost:14700',
)

user_pass = b64encode(b'username:PASSWORD').decode('ascii')
adapter.DEFAULT_HEADERS[u'Authorization'] = u'Basic %s' % user_pass

api = Iota(
    adapter=adapter,
    seed = b'DMSWNXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX')

I'm not sure though if there is a more elegant way. Modifying default header attributes seems a little workaround-ish. Should there be an 'extra_header' argument to the BaseAdapter?

Apart from that, the authentication can also be done right in the url as e.g. here. But I found it a little more elegant to do it the first way.

[todofixthis]

Hey @HerrMuellerluedenscheid thanks for reporting this! I think this is a shortcoming in PyOTA — we should definitely support this out-of-the-box, no hacking necessary (:

[todofixthis]

Hey @HerrMuellerluedenscheid out of curiosity, does the adapter work if username/password are included in the node URI?

E.g.:

api = Iota("http://username:password@localhost:14265")

(don't know why I didn't think of this until just now; sorry!)

[HerrMuellerluedenscheid]

Hey! Yes, that works as well. So, I don't know if it is worth to have this explicitly in the __init__ signature except that it is probably more obvious to understand for less experienced developers, I guess. Am 13.01.2018 11:26 nachm. schrieb "Phoenix" <notifications@github.com>:

…

Hey @HerrMuellerluedenscheid <https://github.com/herrmuellerluedenscheid> out of curiosity, does the adapter work if username/password are included in the node URI? E.g.: api = ***@***.***:14265") — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#129 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AA_Yd6zzaJ2wPmHeF8mzLAif2sQCTYPmks5tKS16gaJpZM4RUOwA> .

[todofixthis]

Sweet. I like that you included a documentation update in your PR. What do you say to this: Let's keep the existing functionality then (https://www.python.org/dev/peps/pep-0020/ — "There should be one-- and preferably only one --obvious way to do it."), but add the auth info/example to the documentation.

[HerrMuellerluedenscheid]

I agree. Explicit is better than implicit, though :) However, that's probably the cleaner way to go. Going to update the pr on Monday!

[HerrMuellerluedenscheid]

Basic authentication via URLs is deprecated (Wikipedia) and disabled in some browsers (e.g. firefox and chrome), as I just found out. So, should we stick to the URL encoded version or better use python.request.auth module?