requests auth this module contains the authentication handlers for requests returns a basic auth string i want us to put a bigol comment on top of it that says that this behaviour is dumb but we need to preserve it because people are relying on it lukasa these are here solely to maintain backwards compatibility for things like ints this will be removed in 3 0 0 if not isinstanceusername basestring warnings warn nonstring usernames will no longer be supported in requests 3 0 0 please convert the object you ve passed in r to a string or bytes object in the near future to avoid problems formatusername categorydeprecationwarning username strusername if not isinstancepassword basestring warnings warn nonstring passwords will no longer be supported in requests 3 0 0 please convert the object you ve passed in r to a string or bytes object in the near future to avoid problems formattypepassword categorydeprecationwarning password strpassword end removal if isinstanceusername str username username encodelatin1 if isinstancepassword str password password encodelatin1 authstr basic tonativestring b64encodeb joinusername password strip return authstr class authbase attaches http basic authentication to the given request object def initself username password self username username self password password def eqself other return all self username getattrother username none self password getattrother password none def neself other return not self other def callself r r headersization basicauthstrself username self password return r class httpproxyauthhttpbasicauth attaches http digest authentication to the given request object def initself username password self username username self password password keep state in perthread local storage self threadlocal threading local def initperthreadstateself ensure state is initialized just once perthread if not hasattrself threadlocal init self threadlocal init true self threadlocal lastnonce self threadlocal noncecount 0 self threadlocal chal self threadlocal pos none self threadlocal num401calls none def builddigestheaderself method url realm self threadlocal chalrealm nonce self threadlocal chalnonce qop self threadlocal chal getqop algorithm self threadlocal chal getalgorithm opaque self threadlocal chal getopaque hashutf8 none if algorithm is none algorithm md5 else algorithm algorithm upper lambdas assume digest modules are imported at the top level if algorithm md5 or algorithm md5sess def md5utf8x if isinstancex str x x encodeutf8 return hashlib md5x hexdigest hashutf8 md5utf8 elif algorithm sha def shautf8x if isinstancex str x x encodeutf8 return hashlib sha1x hexdigest hashutf8 shautf8 elif algorithm sha256 def sha256utf8x if isinstancex str x x encodeutf8 return hashlib sha256x hexdigest hashutf8 sha256utf8 elif algorithm sha512 def sha512utf8x if isinstancex str x x encodeutf8 return hashlib sha512x hexdigest hashutf8 sha512utf8 kd lambda s d hashutf8fs d noqa e731 if hashutf8 is none return none xxx not implemented yet entdig none pparsed urlparseurl path is requesturi defined in rfc 2616 which should not be empty path pparsed path or if pparsed query path f pparsed query a1 fself username realm self password a2 fmethod path ha1 hashutf8a1 ha2 hashutf8a2 if nonce self threadlocal lastnonce self threadlocal noncecount 1 else self threadlocal noncecount 1 ncvalue fself threadlocal noncecount 08x s strself threadlocal noncecount encodeutf8 s nonce encodeutf8 s time ctime encodeutf8 s os urandom8 cnonce hashlib sha1s hexdigest 16 if algorithm md5sess ha1 hashutf8fha1 nonce cnonce if not qop respdig kdha1 fnonce ha2 elif qop auth or auth in qop split noncebit fnonce ncvalue cnonce auth ha2 respdig kdha1 noncebit else xxx handle authint return none self threadlocal lastnonce nonce xxx should the partial digests be encoded too base f usernameself username realmrealm noncenonce f uripath responserespdig if opaque base f opaqueopaque if algorithm base f algorithmalgorithm if entdig base f digestentdig if qop base f qopauth ncncvalue cnoncecnonce return fdigest base def handleredirectself r kwargs takes the given response and tries digestauth if needed rtype requests response if response is not 4xx do not auth see https github compsfrequestsissues3772 rewind the file position indicator of the body to where it was to resend the request consume content and release the original connection to allow our new request to reuse the same one initialize perthread state if needed if we have a saved nonce skip the 401 in the case of httpdigestauth being reused and the body of the previous request was a filelike object pos has the file position of the previous body ensure it s set to none returns a basic auth string i want us to put a big ol comment on top of it that says that this behaviour is dumb but we need to preserve it because people are relying on it lukasa these are here solely to maintain backwards compatibility for things like ints this will be removed in 3 0 0 end removal base class that all auth implementations derive from attaches http basic authentication to the given request object attaches http proxy authentication to a given request object attaches http digest authentication to the given request object keep state in per thread local storage ensure state is initialized just once per thread rtype str lambdas assume digest modules are imported at the top level noqa e731 xxx not implemented yet path is request uri defined in rfc 2616 which should not be empty xxx handle auth int xxx should the partial digests be encoded too reset num_401_calls counter on redirects takes the given response and tries digest auth if needed rtype requests response if response is not 4xx do not auth see https github com psf requests issues 3772 rewind the file position indicator of the body to where it was to resend the request consume content and release the original connection to allow our new request to reuse the same one initialize per thread state if needed if we have a saved nonce skip the 401 in the case of httpdigestauth being reused and the body of the previous request was a file like object pos has the file position of the previous body ensure it s set to none
import hashlib
import os
import re
import threading
import time
import warnings
from base64 import b64encode

from ._internal_utils import to_native_string
from .compat import basestring, str, urlparse
from .cookies import extract_cookies_to_jar
from .utils import parse_dict_header

CONTENT_TYPE_FORM_URLENCODED = "application/x-www-form-urlencoded"
CONTENT_TYPE_MULTI_PART = "multipart/form-data"


def _basic_auth_str(username, password):
    

    
    
    
    
    
    
    
    if not isinstance(username, basestring):
        warnings.warn(
            "Non-string usernames will no longer be supported in Requests "
            "3.0.0. Please convert the object you've passed in ({!r}) to "
            "a string or bytes object in the near future to avoid "
            "problems.".format(username),
            category=DeprecationWarning,
        )
        username = str(username)

    if not isinstance(password, basestring):
        warnings.warn(
            "Non-string passwords will no longer be supported in Requests "
            "3.0.0. Please convert the object you've passed in ({!r}) to "
            "a string or bytes object in the near future to avoid "
            "problems.".format(type(password)),
            category=DeprecationWarning,
        )
        password = str(password)
    

    if isinstance(username, str):
        username = username.encode("latin1")

    if isinstance(password, str):
        password = password.encode("latin1")

    authstr = "Basic " + to_native_string(
        b64encode(b":".join((username, password))).strip()
    )

    return authstr


class AuthBase:
    

    def __call__(self, r):
        raise NotImplementedError("Auth hooks must be callable.")


class HTTPBasicAuth(AuthBase):
    

    def __init__(self, username, password):
        self.username = username
        self.password = password

    def __eq__(self, other):
        return all(
            [
                self.username == getattr(other, "username", None),
                self.password == getattr(other, "password", None),
            ]
        )

    def __ne__(self, other):
        return not self == other

    def __call__(self, r):
        r.headers["Authorization"] = _basic_auth_str(self.username, self.password)
        return r


class HTTPProxyAuth(HTTPBasicAuth):
    

    def __call__(self, r):
        r.headers["Proxy-Authorization"] = _basic_auth_str(self.username, self.password)
        return r


class HTTPDigestAuth(AuthBase):
    

    def __init__(self, username, password):
        self.username = username
        self.password = password
        
        self._thread_local = threading.local()

    def init_per_thread_state(self):
        
        if not hasattr(self._thread_local, "init"):
            self._thread_local.init = True
            self._thread_local.last_nonce = ""
            self._thread_local.nonce_count = 0
            self._thread_local.chal = {}
            self._thread_local.pos = None
            self._thread_local.num_401_calls = None

    def build_digest_header(self, method, url):
        

        realm = self._thread_local.chal["realm"]
        nonce = self._thread_local.chal["nonce"]
        qop = self._thread_local.chal.get("qop")
        algorithm = self._thread_local.chal.get("algorithm")
        opaque = self._thread_local.chal.get("opaque")
        hash_utf8 = None

        if algorithm is None:
            _algorithm = "MD5"
        else:
            _algorithm = algorithm.upper()
        
        if _algorithm == "MD5" or _algorithm == "MD5-SESS":

            def md5_utf8(x):
                if isinstance(x, str):
                    x = x.encode("utf-8")
                return hashlib.md5(x).hexdigest()

            hash_utf8 = md5_utf8
        elif _algorithm == "SHA":

            def sha_utf8(x):
                if isinstance(x, str):
                    x = x.encode("utf-8")
                return hashlib.sha1(x).hexdigest()

            hash_utf8 = sha_utf8
        elif _algorithm == "SHA-256":

            def sha256_utf8(x):
                if isinstance(x, str):
                    x = x.encode("utf-8")
                return hashlib.sha256(x).hexdigest()

            hash_utf8 = sha256_utf8
        elif _algorithm == "SHA-512":

            def sha512_utf8(x):
                if isinstance(x, str):
                    x = x.encode("utf-8")
                return hashlib.sha512(x).hexdigest()

            hash_utf8 = sha512_utf8

        KD = lambda s, d: hash_utf8(f"{s}:{d}")  

        if hash_utf8 is None:
            return None

        
        entdig = None
        p_parsed = urlparse(url)
        
        path = p_parsed.path or "/"
        if p_parsed.query:
            path += f"?{p_parsed.query}"

        A1 = f"{self.username}:{realm}:{self.password}"
        A2 = f"{method}:{path}"

        HA1 = hash_utf8(A1)
        HA2 = hash_utf8(A2)

        if nonce == self._thread_local.last_nonce:
            self._thread_local.nonce_count += 1
        else:
            self._thread_local.nonce_count = 1
        ncvalue = f"{self._thread_local.nonce_count:08x}"
        s = str(self._thread_local.nonce_count).encode("utf-8")
        s += nonce.encode("utf-8")
        s += time.ctime().encode("utf-8")
        s += os.urandom(8)

        cnonce = hashlib.sha1(s).hexdigest()[:16]
        if _algorithm == "MD5-SESS":
            HA1 = hash_utf8(f"{HA1}:{nonce}:{cnonce}")

        if not qop:
            respdig = KD(HA1, f"{nonce}:{HA2}")
        elif qop == "auth" or "auth" in qop.split(","):
            noncebit = f"{nonce}:{ncvalue}:{cnonce}:auth:{HA2}"
            respdig = KD(HA1, noncebit)
        else:
            
            return None

        self._thread_local.last_nonce = nonce

        
        base = (
            f'username="{self.username}", realm="{realm}", nonce="{nonce}", '
            f'uri="{path}", response="{respdig}"'
        )
        if opaque:
            base += f', opaque="{opaque}"'
        if algorithm:
            base += f', algorithm="{algorithm}"'
        if entdig:
            base += f', digest="{entdig}"'
        if qop:
            base += f', qop="auth", nc={ncvalue}, cnonce="{cnonce}"'

        return f"Digest {base}"

    def handle_redirect(self, r, **kwargs):
        
        if r.is_redirect:
            self._thread_local.num_401_calls = 1

    def handle_401(self, r, **kwargs):
        

        
        
        if not 400 <= r.status_code < 500:
            self._thread_local.num_401_calls = 1
            return r

        if self._thread_local.pos is not None:
            
            
            r.request.body.seek(self._thread_local.pos)
        s_auth = r.headers.get("www-authenticate", "")

        if "digest" in s_auth.lower() and self._thread_local.num_401_calls < 2:
            self._thread_local.num_401_calls += 1
            pat = re.compile(r"digest ", flags=re.IGNORECASE)
            self._thread_local.chal = parse_dict_header(pat.sub("", s_auth, count=1))

            
            
            r.content
            r.close()
            prep = r.request.copy()
            extract_cookies_to_jar(prep._cookies, r.request, r.raw)
            prep.prepare_cookies(prep._cookies)

            prep.headers["Authorization"] = self.build_digest_header(
                prep.method, prep.url
            )
            _r = r.connection.send(prep, **kwargs)
            _r.history.append(r)
            _r.request = prep

            return _r

        self._thread_local.num_401_calls = 1
        return r

    def __call__(self, r):
        
        self.init_per_thread_state()
        
        if self._thread_local.last_nonce:
            r.headers["Authorization"] = self.build_digest_header(r.method, r.url)
        try:
            self._thread_local.pos = r.body.tell()
        except AttributeError:
            
            
            
            
            self._thread_local.pos = None
        r.register_hook("response", self.handle_401)
        r.register_hook("response", self.handle_redirect)
        self._thread_local.num_401_calls = 1

        return r

    def __eq__(self, other):
        return all(
            [
                self.username == getattr(other, "username", None),
                self.password == getattr(other, "password", None),
            ]
        )

    def __ne__(self, other):
        return not self == other