Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP
Experimental BrowserID-and-OAuth plugin for use with sync
Branch: master
Pull request Compare This branch is 27 commits behind mozilla-services:master.

Fetching latest commit…

Cannot retrieve the latest commit at this time

Failed to load latest commit information.
repoze
.gitignore
CHANGES.txt
MANIFEST.in
README.rst
setup.py

README.rst

repoze.who.plugins.vepauth

This is a repoze.who plugin for automated authentication via BrowserID:

https://browserid.org/ https://wiki.mozilla.org/Identity/BrowserIDSync

The plugin implements an experimental protocol for authenticating to ReSTful web services with the Verified Email Protocol, a.k.a Mozilla's BrowserID project. It is designed for use in automated tools like the Firefox Sync Client. If you're looking for something to use for human visitors on your site, please try:

http://github.com/mozilla-services/repoze.who.plugins.browserid

When accessing a protected resource, the server will generate a 401 challenge response with the scheme "OAuth+VEP" as follows:

> GET /protected_resource HTTP/1.1
> Host: example.com

< HTTP/1.1 401 Unauthorized
< WWW-Authenticate: OAuth+VEP url="/request_token"

The client should extract the url from this challenge and POST a VEP assertion to that location. This will create a new authentication session and return a set of OAuth client credentials:

> POST /request_token HTTP/1.1
> Host: example.com
> Content-Type: application/x-www-form-urlencoded
>
> assertion=VEP_ASSERTION_DATA

< HTTP/1.1 200 OK
< Content-Type: application/json
<
< {
<   "oauth_consumer_key": SESSION_TOKEN,
<   "oauth_consumer_secret": SESSION_SECRET
< }

Subsequent requests should be signed using these credentials in Two-Legged OAuth mode:

> GET /protected_resource HTTP/1.1
> Host: example.com
> Authorization: OAuth oauth_consumer_key=SESSION_TOKEN,
>                      oauth_signature_method="HMAC-SHA1",
>                      oauth_version="1.0",
>                      oauth_timestamp=TIMESTAMP,
>                      oauth_nonce=NONCE
>                      oauth_signature=SIGNATURE

< HTTP/1.1 200 OK
< Content-Type: text/plain
<
< For your eyes only:  secret data!

Session tokens are timestamped and will eventually expire. If this happens you will receive a 401 response as before, and should POST a new assertion to obtain fresh credentials.

Something went wrong with that request. Please try again.