kennethreitz e0717e32ba v5.2: auth ext + OpenAPI security schemes + security-headers middleware ...

- responder.ext.auth: BearerAuth/BasicAuth/APIKeyAuth schemes usable as
  dependencies (inject the principal) or called directly; sync/async verify,
  constant-time static-secret paths, correct 401 + WWW-Authenticate.
- OpenAPI security: api.add_security_scheme()/scheme.register(api) populate
  components.securitySchemes (Swagger Authorize button); security= on routes/
  verb decorators marks per-op requirements; default=True requires globally.
- API(security_headers=True) + responder.middleware.SecurityHeadersMiddleware:
  opt-in nosniff/X-Frame-Options/Referrer-Policy (+ optional CSP/Permissions),
  preserving handler-set headers.
- DI: callable instances with async __call__ are now awaited (not run in a
  thread), which is what lets an auth scheme object be a dependency.

Backwards-compatible. 490 tests pass; ruff + mypy clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-28 20:02:35 -04:00

..

source

v5.2: auth ext + OpenAPI security schemes + security-headers middleware

2026-06-28 20:02:35 -04:00

make.bat

docs

2018-10-11 12:59:27 -04:00

Makefile

docs

2018-10-11 12:59:27 -04:00

migration-v5.md

v5: fix 7 bugs found by the adversarial review of the v5 diff

2026-06-28 11:19:15 -04:00