Allow other autentification methods
remi-trosset opened this issue · 0 comments
The library allows to define a token parameter that is put in headers and that's great.
However, I'm using an other authentication method in headers: {'x-apikey': 'my_apikey'}
Api key is a custom authentication method that also exists in other forms, as : {'x-api-key': 'my_apikey'}
So, I need a way to authenticate with headers in a custom way.
As a workaround, I can use the 'headers' key in each task definition, but the secret value is not hidden from the report, and that's a huge security issue.
So, it would be nice to be able to give spintest a function as a new parameter, to build the authentication headers, returning a dict with custom keys/values.
For exemple:
The current "Authorizatioin" header is moved to this function:
def build_bearer_authentication(token: Union[str, Callable[..., str]]) -> dict:
return {"Authorization": "Bearer " + (token() if callable(token) else token)}
The spintest function has a new parameter with the bearer function by default, so no breaking change:
def spintest(
urls: List[str],
tasks: List[Dict[str, str]],
token: Union[str, Callable[..., str], None] = None,
authentication_callback: Callable[..., dict] = build_bearer_authentication,
parallel: bool = False,
verify: bool = True,
generate_report: Optional[str] = None,
):
and in task.py, it becomes:
if self.output.get("__token__"):
token = self.output["__token__"]
authentication_headers = authentication_callback(token)
self.task["headers"].update(authentication_headers)
I think, this way, the token is hidden in the report regardless the header form as we always use the same token.