HeaderIdentityProvider

ctrlrun.HeaderIdentityProvider — class, defined at src/ctrlrun/identity.py:126

class HeaderIdentityProvider()
    def __init__(agent_header: str, user_header: str | None, issuer: str | None)

The principal named by a trusted HTTP header (§3.3). A trusted header is worth exactly what the thing that sets it is worth. This is correct behind a proxy that authenticates the caller and overwrites the header on every request, and worthless anywhere else: if the agent can set the header, the agent chooses its own authority. RFC 7239 §8.1 says the same of the header it standardizes — it “cannot be relied upon to be correct, as it may be modified … by every node on the way to the server, including the client making the request”. It carries no claims. A header is a name; manufacturing claims from one would be inventing verified data, which is the one thing this module must not do.

Python API index.
Get started · Why.

Reference

Python API

HeaderIdentityProvider

Next

​Next

Next