Changing locale breaks Authenticating to API for some unknown reason

remi_beges

Hi,

Something that hit us today and that I cannot explain.

We've been using OnShape API intensively (in the past 12 months) and had zero problem with authentication thus far.

Our code is written in Python and the authentication part is derived from OnShape examples.

Today, I just configured a different locale (fr_FR instead of the default english one) on our Django server, and it broke authentication with OnShape for 100% of our requests.

Adding the second line of this code is enough to break auth:

-------------

import locale
locale.setlocale(locale.LC_ALL, 'fr_FR')

-------------

This is how I'm generating the auth:

--------------------------

def _make_auth(self, method, date, nonce, path, query_string='', ctype='application/json'):
        '''
        Create the request signature to authenticate

        Args:
            - method (str): HTTP method
            - date (str): HTTP date header string
            - nonce (str): Cryptographic nonce
            - path (str): URL pathname
            - query (dict, default={}): URL query string in key-value pairs
            - ctype (str, default='application/json'): HTTP Content-Type
        '''
        hmac_str = (method + '\n' + nonce + '\n' + date + '\n' + ctype + '\n' + path +
                    '\n' + query_string + '\n').lower().encode('utf-8')

        signature = base64.b64encode(hmac.new(self._secret_key, hmac_str, digestmod=hashlib.sha256).digest())

        auth = 'On ' + self._access_key.decode('utf-8') + ':HmacSHA256:' + signature.decode('utf-8')

       return auth

-------------------------

Any ideas of why auth fails with non-default locale ? Is this something on our side or yours OnShape ?

remi_beges

I figured it out, changing locale changes date formatting, so the date passed to OnShape in the headers no longer was in expected english (Fri, 31 Jul 2020 07:36:14 GMT -> ven., 31 juil. 2020 07:36:14 GMT), and I'm guessing would not pass validation by OnShape and therefore broke auth.

The solution is to force formatting of the date using computer locale 'C' instead of default locale which may be something else than en_EN