[pylons-discuss] WebTest 2.0.30 has been released.

[Gael Pasgrimaud]

WebTest 2.0.30 has been released.

Here are the changes:

- Add ``Email`` class for input fields with type "email".

- Documentation bearer token and JWT authorization

You can install it via PyPI:

pip install WebTest==2.0.30

Enjoy, and please report any issues you find to the issue tracker at
https://github.com/Pylons/webtest/issues

Thanks!

- WebTest developers

[Mike Orr]

Post by Gael Pasgrimaud
WebTest 2.0.30 has been released.
- Add ``Email`` class for input fields with type "email".
- Documentation bearer token and JWT authorization

What is a bearer token and JWT authorization? Does that mean a CSRF token?

[Gael Pasgrimaud]

Hi,

Post by Mike Orr

Post by Gael Pasgrimaud
WebTest 2.0.30 has been released.
- Add ``Email`` class for input fields with type "email".
- Documentation bearer token and JWT authorization

What is a bearer token and JWT authorization? Does that mean a CSRF token?

It's like basic auth but use tokens in the Authorization headers instead
of base64(user:pass). It's a bit more secure... JWT token may also contains
some extra data (user infos, api scope, etc.) but those are encrypted using
public/private keys. I don't know much about bearer.

Most apis supports one of those, or both.

https://docs.pylonsproject.org/projects/webtest/en/latest/api.html#webtest.app.TestApp.authorization

[Jonathan Vanasco]

Post by Gael Pasgrimaud
It's like basic auth but use tokens in the Authorization headers instead
of base64(user:pass). It's a bit more secure... JWT token may also contains
some extra data (user infos, api scope, etc.) but those are encrypted using
public/private keys. I don't know much about bearer.

A "Bearer Token" is the common type of "Access Token" in oAuth2 and used by
many APIs.

In oAuth2, a client often authenticates with a key+secret and is issued a
"Bearer Token" in return. The "Bearer Token" is then sent in the HTTPS
headers, and can be invalidated from the authorizing application.

[Jonathan Vanasco]

clarification: oAuth2 supports some other flows/tokens too - but the Bearer
concept is vert common.