Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
WebSocket SDK for Centrifugo (and any Centrifuge-based server) on top of Python asyncio library
This is a WebSocket real-time SDK for Centrifugo server (and any Centrifuge-based server) on top of Python asyncio library.
[!TIP] If you are looking for Centrifugo server API client – check out pycent instead.
Before starting to work with this library check out Centrifugo client SDK API specification as it contains common information about Centrifugal real-time SDK behavior. This SDK supports all major features of Centrifugo client protocol - see SDK feature matrix.
pip install centrifuge-python
Then in your code:
from centrifuge import Client
See example code and how to run it locally.
By default, SDK uses JSON protocol. If you want to use Protobuf protocol instead then pass use_protobuf=True
option to Client
constructor.
When using JSON protocol:
json.dumps
before sending to server. So make sure you pass only JSON-serializable data to the library.json.loads
internally before passing to your code.When using Protobuf protocol:
bytes
or None
if optional. If you pass non-bytes
data – exception will be raised.bytes
or None
if not present.bytes
before passing to the library.Event callbacks are called by SDK using await
internally, the websocket connection read loop is blocked for the time SDK waits for the callback to be executed. This means that if you need to perform long operations in callbacks consider moving the work to a separate coroutine/task to return fast and continue reading data from the websocket.
The fact WebSocket read is blocked for the time we execute callbacks means that you can not call awaitable SDK APIs from callback – because SDK does not have a chance to read the reply. You will get OperationTimeoutError
exception. The rule is the same - do the work asynchronously, for example use asyncio.ensure_future
.
To run example, first start Centrifugo with config like this:
{
"token_hmac_secret_key": "secret",
"namespaces": [
{
"name": "example",
"presence": true,
"history_size": 300,
"history_ttl": "300s",
"join_leave": true,
"force_push_join_leave": true,
"allow_publish_for_subscriber": true,
"allow_presence_for_subscriber": true,
"allow_history_for_subscriber": true
}
]
}
And then:
python -m venv env
. env/bin/activate
make dev
python example.py
To run tests, first start Centrifugo server:
docker pull centrifugo/centrifugo:v5
docker run -d -p 8000:8000 -e CENTRIFUGO_LOG_LEVEL=trace \
-e CENTRIFUGO_TOKEN_HMAC_SECRET_KEY="secret" -e CENTRIFUGO_PRESENCE=true \
-e CENTRIFUGO_JOIN_LEAVE=true -e CENTRIFUGO_FORCE_PUSH_JOIN_LEAVE=true \
-e CENTRIFUGO_HISTORY_TTL=300s -e CENTRIFUGO_HISTORY_SIZE=100 \
-e CENTRIFUGO_DELTA_PUBLISH=true -e CENTRIFUGO_ALLOWED_DELTA_TYPES="fossil" \
-e CENTRIFUGO_FORCE_RECOVERY=true -e CENTRIFUGO_USER_SUBSCRIBE_TO_PERSONAL=true \
-e CENTRIFUGO_ALLOW_PUBLISH_FOR_SUBSCRIBER=true -e CENTRIFUGO_ALLOW_PRESENCE_FOR_SUBSCRIBER=true \
-e CENTRIFUGO_ALLOW_HISTORY_FOR_SUBSCRIBER=true centrifugo/centrifugo:v5 centrifugo
And then (from cloned repo root):
python -m venv env
. env/bin/activate
make dev
make test
FAQs
WebSocket SDK for Centrifugo (and any Centrifuge-based server) on top of Python asyncio library
We found that centrifuge-python demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.