Authorization

class oauthlib.oauth1.AuthorizationEndpoint(request_validator, token_generator=None)

An endpoint responsible for letting authenticated users authorize access to their protected resources to a client.

Typical use would be to have two views, one for displaying the authorization form and one to process said form on submission.

The first view will want to utilize get_realms_and_credentials to fetch requested realms and useful client credentials, such as name and description, to be used when creating the authorization form.

During form processing you can use create_authorization_response to validate the request, create a verifier as well as prepare the final redirection URI used to send the user back to the client.

See Request Validator for details on which validator methods to implement for this endpoint.

create_authorization_response(uri, http_method='GET', body=None, headers=None, realms=None, credentials=None)

Create an authorization response, with a new request token if valid.

Parameters:

• uri – The full URI of the token request.
• http_method – A valid HTTP verb, i.e. GET, POST, PUT, HEAD, etc.
• body – The request body as a string.
• headers – The request headers as a dict.
• credentials – A list of credentials to include in the verifier.

Returns:

A tuple of 3 elements. 1. A dict of headers to set on the response. 2. The response body as a string. 3. The response status code as an integer.

If the callback URI tied to the current token is “oob”, a response with a 200 status code will be returned. In this case, it may be desirable to modify the response to better display the verifier to the client.

An example of an authorization request:

>>> from your_validator import your_validator
>>> from oauthlib.oauth1 import AuthorizationEndpoint
>>> endpoint = AuthorizationEndpoint(your_validator)
>>> h, b, s = endpoint.create_authorization_response(
...     'https://your.provider/authorize?oauth_token=...',
...     credentials={
...         'extra': 'argument',
...     })
>>> h
{'Location': 'https://the.client/callback?oauth_verifier=...&extra=argument'}
>>> b
None
>>> s
302

An example of a request with an “oob” callback:

>>> from your_validator import your_validator
>>> from oauthlib.oauth1 import AuthorizationEndpoint
>>> endpoint = AuthorizationEndpoint(your_validator)
>>> h, b, s = endpoint.create_authorization_response(
...     'https://your.provider/authorize?foo=bar',
...     credentials={
...         'extra': 'argument',
...     })
>>> h
{'Content-Type': 'application/x-www-form-urlencoded'}
>>> b
'oauth_verifier=...&extra=argument'
>>> s
200

create_verifier(request, credentials)

Create and save a new request token.

Parameters:

• request (oauthlib.common.Request) – OAuthlib request.
• credentials – A dict of extra token credentials.

Returns:

The verifier as a dict.

get_realms_and_credentials(uri, http_method='GET', body=None, headers=None)

Fetch realms and credentials for the presented request token.

Parameters:

• uri – The full URI of the token request.
• http_method – A valid HTTP verb, i.e. GET, POST, PUT, HEAD, etc.
• body – The request body as a string.
• headers – The request headers as a dict.

Returns:

A tuple of 2 elements. 1. A list of request realms. 2. A dict of credentials which may be useful in creating the authorization form.