diff --git a/rest_framework_httpsignature/authentication.py b/rest_framework_httpsignature/authentication.py index 5e31600..2b9f489 100644 --- a/rest_framework_httpsignature/authentication.py +++ b/rest_framework_httpsignature/authentication.py @@ -86,7 +86,11 @@ def authenticate(self, request): sent_string = request.META.get(authorization_header) if not sent_string: raise exceptions.AuthenticationFailed('No signature provided') + + # Check if signature string matches signature pattern sent_signature = self.get_signature_from_signature_string(sent_string) + if not sent_signature: + return None # Fetch credentials for API key from the data store. try: diff --git a/rest_framework_httpsignature/tests.py b/rest_framework_httpsignature/tests.py index e2eda6e..06daa6a 100644 --- a/rest_framework_httpsignature/tests.py +++ b/rest_framework_httpsignature/tests.py @@ -177,11 +177,24 @@ def test_only_api_key(self): self.assertRaises(AuthenticationFailed, self.auth.authenticate, request) + def test_no_signature(self): + request = RequestFactory().get( + ENDPOINT, {}, + HTTP_X_API_KEY=KEYID, + HTTP_AUTHORIZATION='no-signature') + res = self.auth.authenticate(request) + self.assertIsNone(res) + def test_bad_signature(self): + headers = ['(request-target)', 'accept', 'date', 'host'] + signature = build_signature( + headers, + key_id=KEYID, + signature='some-wrong-value') request = RequestFactory().get( ENDPOINT, {}, HTTP_X_API_KEY=KEYID, - HTTP_AUTHORIZATION='some-wrong-value') + HTTP_AUTHORIZATION=signature) self.assertRaises(AuthenticationFailed, self.auth.authenticate, request)