Fix #73: Parse token from Authorization header

README.rst

@@ -85,6 +85,10 @@ your settings. When this setting is added, you must pass that value in as the
 
     GET http://127.0.0.1:8000/watchman/?watchman-token=:token
 
+Or by setting the ``Authorization: WATCHMAN-TOKEN`` header on the request::
+
+    curl -X GET -H "Authorization: WATCHMAN-TOKEN Token=\":token\"" http://127.0.0.1:8000/watchman/
+
 If you want to change the token name, you can set the ``WATCHMAN_TOKEN_NAME``.
 The value of this setting will be the **GET** parameter that you must pass in::
 

tests/test_views.py

@@ -135,7 +135,7 @@ def test_response_404_when_none_specified(self):
 
     @override_settings(WATCHMAN_TOKEN='ABCDE')
     @override_settings(WATCHMAN_AUTH_DECORATOR='watchman.decorators.token_required')
-    def test_login_not_required(self):
+    def test_login_not_required_with_get_param(self):
         # Have to manually reload settings here because override_settings
         # happens after self.setUp(), but before self.tearDown()
         reload_settings()
@@ -147,6 +147,40 @@ def test_login_not_required(self):
 
         self.assertEqual(response.status_code, 200)
 
+    @override_settings(WATCHMAN_TOKEN='ABCDE')
+    @override_settings(WATCHMAN_AUTH_DECORATOR='watchman.decorators.token_required')
+    def test_login_not_required_with_authorization_header(self):
+        # Have to manually reload settings here because override_settings
+        # happens after self.setUp(), but before self.tearDown()
+        reload_settings()
+        request = RequestFactory().get('/', HTTP_AUTHORIZATION='WATCHMAN-TOKEN Token="ABCDE"')
+        response = views.status(request)
+        self.assertEqual(response.status_code, 200)
+
+    @override_settings(WATCHMAN_TOKEN='ABCDE')
+    @override_settings(WATCHMAN_AUTH_DECORATOR='watchman.decorators.token_required')
+    def test_login_fails_with_invalid_get_param(self):
+        # Have to manually reload settings here because override_settings
+        # happens after self.setUp(), but before self.tearDown()
+        reload_settings()
+        request = RequestFactory().get('/', data={
+            'watchman-token': '12345',
+        })
+
+        response = views.status(request)
+
+        self.assertEqual(response.status_code, 403)
+
+    @override_settings(WATCHMAN_TOKEN='ABCDE')
+    @override_settings(WATCHMAN_AUTH_DECORATOR='watchman.decorators.token_required')
+    def test_login_fails_with_invalid_authorization_header(self):
+        # Have to manually reload settings here because override_settings
+        # happens after self.setUp(), but before self.tearDown()
+        reload_settings()
+        request = RequestFactory().get('/', HTTP_AUTHORIZATION='WATCHMAN-TOKEN Token="12345"')
+        response = views.status(request)
+        self.assertEqual(response.status_code, 403)
+
     @override_settings(WATCHMAN_AUTH_DECORATOR='django.contrib.auth.decorators.login_required')
     def test_response_when_login_required_is_redirect(self):
         # Have to manually reload settings here because override_settings

watchman/decorators.py

@@ -1,9 +1,10 @@
-from django.http import HttpResponseForbidden
-from django.views.decorators.csrf import csrf_exempt
-
 from functools import wraps
+import re
 import traceback
 
+from django.http import HttpResponseForbidden
+from django.views.decorators.csrf import csrf_exempt
+
 from watchman import settings
 
 
@@ -37,13 +38,38 @@ def token_required(view_func):
 
     """
 
+    def _parse_auth_header(auth_header):
+        """
+        Parse the `Authorization` header
+
+        Expected format: `WATCHMAN-TOKEN Token="ABC123"`
+        """
+
+        reg = re.compile('(\w+)[=] ?"?(\w+)"?')
+        header_dict = dict(reg.findall(auth_header))
+        return header_dict['Token']
+
+    def _get_passed_token(request):
+        """
+        Try to get the passed token, starting with the header and fall back to `GET` param
+        """
+
+        try:
+            auth_header = request.META['HTTP_AUTHORIZATION']
+            token = _parse_auth_header(auth_header)
+        except KeyError:
+            token = request.GET.get(settings.WATCHMAN_TOKEN_NAME)
+        return token
+
     def _validate_token(request):
         watchman_token = settings.WATCHMAN_TOKEN
+
         if watchman_token is None:
             return True
 
-        watchman_token_name = settings.WATCHMAN_TOKEN_NAME
-        return watchman_token == request.GET.get(watchman_token_name)
+        passed_token = _get_passed_token(request)
+
+        return watchman_token == passed_token
 
     @csrf_exempt
     @wraps(view_func)