Make check for Authorization header more robust.

[joestump]

Addresses the following issues:

• Support parsing HTTP_AUTHORIZATION header in case of mod_wsgi deployment #77
• uppercase 'Authorization' header #68

The check for Authorization is now case insensitive and the library also checks for HTTP_AUTHORIZATION so you can pass WSGI headers directly.

Here are the tests without the patch applied:

(python-oauth2)Joes-MacBook:python-oauth2 jstump$ py.test
====================================================================== test session starts ======================================================================
platform darwin -- Python 2.7.6 -- py-1.4.30 -- pytest-2.7.2
rootdir: /Users/jstump/Dropbox/jstump/dev/python-oauth2, inifile: 
collected 72 items 

tests/test_oauth.py .......................FF...............................................

=========================================================================== FAILURES ============================================================================
______________________________________________ TestRequest.test_from_request_is_case_insensitive_checking_for_auth ______________________________________________

self = <tests.test_oauth.TestRequest testMethod=test_from_request_is_case_insensitive_checking_for_auth>

    def test_from_request_is_case_insensitive_checking_for_auth(self):
        """Checks for the Authorization header should be case insensitive."""
        url = "http://sp.example.com/"

        params = {
            'oauth_version': "1.0",
            'oauth_nonce': "4572616e48616d6d65724c61686176",
            'oauth_timestamp': "137131200",
            'oauth_consumer_key': "0685bd9184jfhq22",
            'oauth_signature_method': "HMAC-SHA1",
            'oauth_token': "ad180jjd733klru7",
            'oauth_signature': "wOJIO9A2W5mFwDgiDvZbTSMK%2FPY%3D",
        }

        req = oauth.Request("GET", url, params)
        headers = req.to_header()

        # Munge the headers
        headers['authorization'] = headers['Authorization']
        del headers['Authorization']

        # Test from the headers
        req = oauth.Request.from_request("GET", url, headers)
>       self.assertEquals(req.method, "GET")
E       AttributeError: 'NoneType' object has no attribute 'method'

tests/test_oauth.py:969: AttributeError
_________________________________________________________ TestRequest.test_from_request_works_with_wsgi _________________________________________________________

self = <tests.test_oauth.TestRequest testMethod=test_from_request_works_with_wsgi>

    def test_from_request_works_with_wsgi(self):
        """Make sure WSGI header HTTP_AUTHORIZATION is detected correctly."""
        url = "http://sp.example.com/"

        params = {
            'oauth_version': "1.0",
            'oauth_nonce': "4572616e48616d6d65724c61686176",
            'oauth_timestamp': "137131200",
            'oauth_consumer_key': "0685bd9184jfhq22",
            'oauth_signature_method': "HMAC-SHA1",
            'oauth_token': "ad180jjd733klru7",
            'oauth_signature': "wOJIO9A2W5mFwDgiDvZbTSMK%2FPY%3D",
        }

        req = oauth.Request("GET", url, params)
        headers = req.to_header()

        # Munge the headers
        headers['HTTP_AUTHORIZATION'] = headers['Authorization']
        del headers['Authorization']

        # Test from the headers
        req = oauth.Request.from_request("GET", url, headers)
>       self.assertEquals(req.method, "GET")
E       AttributeError: 'NoneType' object has no attribute 'method'

tests/test_oauth.py:941: AttributeError
============================================================== 2 failed, 70 passed in 3.20 seconds ==============================================================

[jaitaiwan]

Awesome. LGTM

[rickhanlonii]

This is great!

Just so it's clear to those following along at home, HTTP headers are case-insensitive according to RFC 2616 section 4.2:

Each header field consists of a name followed by a colon (":") and the field value. Field names are case-insensitive.

Also, the field value is allowed to have whitespace, but the field name is not--so there's no need to add trimming here.

[joestump]

@rickhanlonii are you interested in joining @jaitaiwan and I maintaining this library? 😃

[rickhanlonii]

I'd be happy to! 💁

[joestump]

@rickhanlonii welcome to the team. Added you! 👊

[rickhanlonii]

@joestump thanks, happy to help!

[jaitaiwan]

Woot! 2/3 majority time for LGTM haha