Slide 16
Slide 16 text
Snakeoil Academy 2021 • PyCon AU • @m_holtermann
Snakeoil Academy 2021 • PyCon AU • @m_holtermann
>>> import base64, json, hmac
>>> key = b"snakeoil.academy"
>>> data = {"uid": 123, "name": "curlyboi"}
>>> payload = base64.b64encode(json.dumps(data).encode())
>>> mac = hmac.new(key, payload, digestmod="sha256")
>>> payload + b"." + base64.b64encode(mac.digest())
>>> ret
b'eyJ1aWQiOiAxMjMsICJuYW1lIjogImN1cmx5Ym9pIn0=.oJPUWmHZGJIXPCna082U8/SMseX+hZ5av
Kjgt1TKovg='
>>> signed, signature = ret.split(b".", 1)
>>> hmac.compare_digest(signature,
... base64.b64encode(hmac.new(key, signed, digestmod="sha256").digest()))
True
>>> json.loads(base64.b64decode(signed))
{'uid': 123, 'name': 'curlyboi'}