azure-keyvault/azure/keyvault/http_message_security.py
def unprotect_response(self, response, **kwargs):
        """
        Removes protection from the specified response
        :param request: response from the key vault service
        :return: unprotected response with any security protocal encryption removed
        """
        body = response.content
        # if the current message security doesn't support message protection, the body is empty, or the request failed
        # skip protection and return the original response
        if not self.supports_protection() or len(response.content) == 0 or response.status_code != 200:
            return response

        # ensure the content-type is application/jose+json
        if 'application/jose+json' not in response.headers.get('content-type', '').lower():
            raise ValueError('Invalid protected response')

        # deserialize the response into a JwsObject, using response.text so requests handles the encoding
        jws = _JwsObject().deserialize(body)

        # deserialize the protected header
        jws_header = _JwsHeader.from_compact_header(jws.protected)

        # ensure the jws signature kid matches the key from original challenge
        # and the alg matches expected signature alg
        if jws_header.kid != self.server_signature_key.kid \
                or jws_header.alg != 'RS256':
            raise ValueError('Invalid protected response')

        # validate the signature of the jws
        data = (jws.protected + '.' + jws.payload).encode('ascii')
        # verify will raise an InvalidSignature exception if the signature doesn't match
        self.server_signature_key.verify(signature=_b64_to_bstr(jws.signature), data=data)

        # get the unprotected response body
        decrypted = self._unprotect_payload(jws.payload)

        response._content = decrypted
        response.headers['Content-Type'] = 'application/json'

        return response
def unprotect_response(self, response, **kwargs):
        """
        Removes protection from the specified response
        :param request: response from the key vault service
        :return: unprotected response with any security protocal encryption removed
        """
        body = response.content
        # if the current message security doesn't support message protection, the body is empty, or the request failed
        # skip protection and return the original response
        if not self.supports_protection() or len(response.content) == 0 or response.status_code != 200:
            return response

        # ensure the content-type is application/jose+json
        if 'application/jose+json' not in response.headers.get('content-type', '').lower():
            raise ValueError('Invalid protected response')

        # deserialize the response into a JwsObject, using response.text so requests handles the encoding
        jws = _JwsObject().deserialize(body)

        # deserialize the protected header
        jws_header = _JwsHeader.from_compact_header(jws.protected)

        # ensure the jws signature kid matches the key from original challenge
        # and the alg matches expected signature alg
        if jws_header.kid != self.server_signature_key.kid \
                or jws_header.alg != 'RS256':
            raise ValueError('Invalid protected response')

        # validate the signature of the jws
        data = (jws.protected + '.' + jws.payload).encode('ascii')
        # verify will raise an InvalidSignature exception if the signature doesn't match
        self.server_signature_key.verify(signature=_b64_to_bstr(jws.signature), data=data)

        # get the unprotected response body
        decrypted = self._unprotect_payload(jws.payload)

        response._content = decrypted
        response.headers['Content-Type'] = 'application/json'

        return response
def unprotect_response ( self , response , * * kwargs ) : body = response . content # if the current message security doesn't support message protection, the body is empty, or the request failed # skip protection and return the original response if not self . supports_protection ( ) or len ( response . content ) == 0 or response . status_code != 200 : return response # ensure the content-type is application/jose+json if 'application/jose+json' not in response . headers . get ( 'content-type' , '' ) . lower ( ) : raise ValueError ( 'Invalid protected response' ) # deserialize the response into a JwsObject, using response.text so requests handles the encoding jws = _JwsObject ( ) . deserialize ( body ) # deserialize the protected header jws_header = _JwsHeader . from_compact_header ( jws . protected ) # ensure the jws signature kid matches the key from original challenge # and the alg matches expected signature alg if jws_header . kid != self . server_signature_key . kid or jws_header . alg != 'RS256' : raise ValueError ( 'Invalid protected response' ) # validate the signature of the jws data = ( jws . protected + '.' + jws . payload ) . encode ( 'ascii' ) # verify will raise an InvalidSignature exception if the signature doesn't match self . server_signature_key . verify ( signature = _b64_to_bstr ( jws . signature ) , data = data ) # get the unprotected response body decrypted = self . _unprotect_payload ( jws . payload ) response . _content = decrypted response . headers [ 'Content-Type' ] = 'application/json' return response
Removes protection from the specified response
        :param request: response from the key vault service
        :return: unprotected response with any security protocal encryption removed
Removes protection from the specified response : param request : response from the key vault service : return : unprotected response with any security protocal encryption removed