Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
This is a Python port of the supabase js gotrue client. The current state is that there is a features parity but with small differences that are mentioned in the section Differences to the JS client. As of December 14th, we renamed to repo from gotrue-py
to auth-py
to mirror the changes in the JavaScript library.
We are still working on making the gotrue
python library more user-friendly. For now here are some sparse notes on how to install the module.
poetry add gotrue
pip install gotrue
It should be noted there are differences to the JS client. If you feel particulaly strongly about them and want to motivate a change, feel free to make a GitHub issue and we can discuss it there.
Firstly, feature pairity is not 100% with the JS client. In most cases we match the methods and attributes of the JS client and api classes, but is some places (e.g for browser specific code) it didn't make sense to port the code line for line.
There is also a divergence in terms of how errors are raised. In the JS client, the errors are returned as part of the object, which the user can choose to process in whatever way they see fit. In this Python client, we raise the errors directly where they originate, as it was felt this was more Pythonic and adhered to the idioms of the language more directly.
In JS we return the error, but in Python we just raise it.
const { data, error } = client.sign_up(...)
The other key difference is we do not use pascalCase to encode variable and method names. Instead we use the snake_case convention adopted in the Python language.
Also, the gotrue
library for Python parses the date-time string into datetime
Python objects. The JS client keeps the date-time as strings.
Important: This section is outdated, you can be guided by the JS client documentation because this Python client has a lot of parity with the JS client.
To instantiate the client, you'll need the URL and any request headers at a minimum.
from gotrue import SyncGoTrueClient
headers = {
"apiKey": "my-mega-awesome-api-key",
# ... any other headers you might need.
}
client: SyncGoTrueClient = SyncGoTrueClient(url="www.genericauthwebsite.com", headers=headers)
To send a magic email link to the user, just provide the email kwarg to the sign_in
method:
user: Dict[str, Any] = client.sign_up(email="example@gmail.com")
To login with email and password, provide both to the sign_in
method:
user: Dict[str, Any] = client.sign_up(email="example@gmail.com", password="*********")
To sign out of the logged in user, call the sign_out
method. We can then assert that the session and user are null values.
client.sign_out()
assert client.user() is None
assert client.session() is None
We can refesh a users session.
# The user should already be signed in at this stage.
user = client.refresh_session()
assert client.user() is not None
assert client.session() is not None
We would be immensely grateful for any contributions to this project.
FAQs
Python Client Library for Supabase Auth
We found that gotrue demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.