societe-generale/spintest

Allow other autentification methods

remi-trosset opened this issue · 0 comments

The library allows to define a token parameter that is put in headers and that's great.

However, I'm using an other authentication method in headers: {'x-apikey': 'my_apikey'}
Api key is a custom authentication method that also exists in other forms, as : {'x-api-key': 'my_apikey'}

So, I need a way to authenticate with headers in a custom way.

As a workaround, I can use the 'headers' key in each task definition, but the secret value is not hidden from the report, and that's a huge security issue.

So, it would be nice to be able to give spintest a function as a new parameter, to build the authentication headers, returning a dict with custom keys/values.

For exemple:
The current "Authorizatioin" header is moved to this function:

def build_bearer_authentication(token: Union[str, Callable[..., str]]) -> dict:
    return {"Authorization": "Bearer " + (token() if callable(token) else token)}

The spintest function has a new parameter with the bearer function by default, so no breaking change:

def spintest(
    urls: List[str],
    tasks: List[Dict[str, str]],
    token: Union[str, Callable[..., str], None] = None,
    authentication_callback: Callable[..., dict] = build_bearer_authentication,
    parallel: bool = False,
    verify: bool = True,
    generate_report: Optional[str] = None,
):

and in task.py, it becomes:

                if self.output.get("__token__"):
                    token = self.output["__token__"]
                    authentication_headers = authentication_callback(token)
                    self.task["headers"].update(authentication_headers)

I think, this way, the token is hidden in the report regardless the header form as we always use the same token.