-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
# Conflicts: # docs/README.html # docs/README.md # docs/_sources/README.md.txt # docs/index.html # docs/searchindex.js # pystream/models/squire.py
- Loading branch information
Showing
30 changed files
with
821 additions
and
199 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| ## Authentication | ||
| `PyStream` uses two ways of authentication, the `username` and `password` to gain access to the server and | ||
| a `session_token` generated by the server to access directories and streaming content. | ||
|
|
||
| ### Username and Password | ||
| > [Signature Authentication][signature-authentication] | ||
| #### Frontend | ||
| - UI creates hex values for username and password using native JS | ||
| - These hex values are then used the calculate the hash | ||
| - Calculated hash is then base64 encoded using native JS, before sending the signature to the API in an authorization header | ||
|
|
||
| #### Backend | ||
| - API decodes the base64 encoded ascii string, then decodes the HEX received in authorization header | ||
| - Then the value is broken down to, username, signature and timestamp | ||
| - The decoded username is used to get the stored password from env variables, which are then hex encoded | ||
| - API creates a hash signature using the hex username, hex password, and the timestamp | ||
| - These signatures are then compared for authentication purpose | ||
|
|
||
| ### Session Token | ||
| > [Symmetric Encryption][symmetric-encryption] | ||
| - Once the login has been successful, the API creates a randomly generated 64 bit url safe token | ||
| - This token is stored as unique key for each user | ||
| - The API then forms a payload with the username, key, and the timestamp | ||
| - This payload is then encrypted using Cryptography's Fernet, which can be retrieved only using the key | ||
| - This encrypted payload is stored as a cookie before sending a `JSONResponse` with a `redirect_url` | ||
| > Since the UI uses `AJAX` for authentication POST call, a `RedirectResponse` from FastAPI will not work, | ||
| > as the call will simply follow the redirect to `GET` the content instead of redirecting the page. | ||
| - The `redirect_url` from the JSON response is fetched, to alter `location.href` | ||
| > This form of redirect will transfer cookies to the new page but not the headers, | ||
| > so the username and password are lost in the frontend at this point | ||
| - From then on, all calls to the backend including redirects, directory navigation and, streaming will carry the cookie | ||
| - The `session_token` is the only form of authentication from this point onward | ||
|
|
||
| ### References | ||
| - [symmetric-encryption] | ||
| - [signature-authentication] | ||
|
|
||
| [symmetric-encryption]: https://cryptography.io/en/latest/fernet/ | ||
| [signature-authentication]: https://developers.expediagroup.com/docs/products/rapid/resources/reference/signature-authentication |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| ## Authentication | ||
| `PyStream` uses two ways of authentication, the `username` and `password` to gain access to the server and | ||
| a `session_token` generated by the server to access directories and streaming content. | ||
|
|
||
| ### Username and Password | ||
| > [Signature Authentication][signature-authentication] | ||
| #### Frontend | ||
| - UI creates hex values for username and password using native JS | ||
| - These hex values are then used the calculate the hash | ||
| - Calculated hash is then base64 encoded using native JS, before sending the signature to the API in an authorization header | ||
|
|
||
| #### Backend | ||
| - API decodes the base64 encoded ascii string, then decodes the HEX received in authorization header | ||
| - Then the value is broken down to, username, signature and timestamp | ||
| - The decoded username is used to get the stored password from env variables, which are then hex encoded | ||
| - API creates a hash signature using the hex username, hex password, and the timestamp | ||
| - These signatures are then compared for authentication purpose | ||
|
|
||
| ### Session Token | ||
| > [Symmetric Encryption][symmetric-encryption] | ||
| - Once the login has been successful, the API creates a randomly generated 64 bit url safe token | ||
| - This token is stored as unique key for each user | ||
| - The API then forms a payload with the username, key, and the timestamp | ||
| - This payload is then encrypted using Cryptography's Fernet, which can be retrieved only using the key | ||
| - This encrypted payload is stored as a cookie before sending a `JSONResponse` with a `redirect_url` | ||
| > Since the UI uses `AJAX` for authentication POST call, a `RedirectResponse` from FastAPI will not work, | ||
| > as the call will simply follow the redirect to `GET` the content instead of redirecting the page. | ||
| - The `redirect_url` from the JSON response is fetched, to alter `location.href` | ||
| > This form of redirect will transfer cookies to the new page but not the headers, | ||
| > so the username and password are lost in the frontend at this point | ||
| - From then on, all calls to the backend including redirects, directory navigation and, streaming will carry the cookie | ||
| - The `session_token` is the only form of authentication from this point onward | ||
|
|
||
| ### References | ||
| - [symmetric-encryption] | ||
| - [signature-authentication] | ||
|
|
||
| [symmetric-encryption]: https://cryptography.io/en/latest/fernet/ | ||
| [signature-authentication]: https://developers.expediagroup.com/docs/products/rapid/resources/reference/signature-authentication |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.