Search for a command to run...
As an experienced cybersecurity professional with a full-stack development and software engineering background, I am committed to building secure and reliable software solutions. I am passionate about leveraging my expertise in Python, React.js, Django, and other technologies to design and develop cutting-edge applications that meet the highest security and functionality standards.
No comments yet. Be the first to comment.
The Problem Phishing remains one of the top methods for a malicious actor to gain access to a target environment. A vital component of a realistic phishing campaign is a familiar-looking domain address. Using a technique known as "domain squatting," ...
Situation You have an API built with Django Rest Framework You are using SimpleJWT as your authentication backend You have integrated Celery with your Django application and are using it to run background tasks Some of your tasks need to make authen...
Development is hard. One of the challenges newcomers face when learning a programming language is the knowledge gap between them and the people they learn from. This becomes particularly apparent when a beginner is introduced to a high-level program...
Recently, I've been asked by several people about my journey into the field of Information Security. Most of the time, it seems that those that ask are looking for a tip or piece of information that they do not already have--some sort of secret to un...
API keys, also known as application programming interface keys, are codes or tokens used to authenticate and authorize access to an API (Application Programming Interface).
The API provider typically issues API keys to developers who need to integrate with the API. The API key serves as a unique identifier to track and limit the API's usage and enforce any rate limits or other access controls.
Recently, I found myself in a situation where I needed to write integration tests for an API endpoint protected by API keys. Unfortunately, generating an API key for a test and using it for authorization was not well-documented. After some research and experimentation, I eventually found a methodology that worked well.
The API was built using Django and Django REST Framework (DRF). API keys were implemented using the DRF API Keys module. The testing library was pytest.
The solution that I found is shown below:
def test_if_has_api_key_no_payload_returns_400(self, api_client):
# Programatically generate an API key using the APIKey's convenience
# function, create_key. create_key returns a tuple with the APIKey
# object and the plaintext API key. This is important, because the
# APIKey object only contains a hashed value of the key. We have no
# other way of getting the plaintext key, which we need to authenticate
# with the endpoint.
_, key = APIKey.objects.create_key(name="name")
# Initially, I tried posting to the endpoint with the API key in a header
# dictionary, like when using the requests module. After much head-
# scratching, debugging, and research, I found that the DRF APIClient
# expects headers in a slightly different format. I also found that
# the header the application expects, Authorization, is expected
# to be called HTTP_AUTHORIZATION.
res = api_client.post(
self._endpoint,
HTTP_AUTHORIZATION=f"Api-Key {key}",
)
assert res.status_code == status.HTTP_400_BAD_REQUEST
The APIClient is not well documented, according to this helpful person on StackOverflow: https://stackoverflow.com/a/53085606/19300652
And, well...that's all there is to it!