update to support signed requests

Author: Jon Heaton

instagram/bind.py

@@ -103,8 +103,6 @@ def _build_path(self):
 
             if self.api.format:
                 self.path = self.path + '.%s' % self.api.format
-            else:
-                self.path = self.path
 
         def _build_pagination_info(self, content_obj):
             """Extract pagination information in the desired format."""
@@ -114,14 +112,15 @@ def _build_pagination_info(self, content_obj):
             if self.pagination_format == 'dict':
                 return pagination
             raise Exception('Invalid value for pagination_format: %s' % self.pagination_format)
-
+          
         def _do_api_request(self, url, method="GET", body=None, headers=None):
             headers = headers or {}
             if self.signature and self.api.client_ips != None and self.api.client_secret != None:
                 secret = self.api.client_secret
                 ips = self.api.client_ips
                 signature = hmac.new(secret, ips, sha256).hexdigest()
                 headers['X-Insta-Forwarded-For'] = '|'.join([ips, signature])
+
             response, content = OAuth2Request(self.api).make_request(url, method=method, body=body, headers=headers)
             if response['status'] == '503' or response['status'] == '429':
                 raise InstagramAPIError(response['status'], "Rate limited", "Your client is making too many request per second")

instagram/client.py

@@ -26,7 +26,7 @@ def __init__(self, *args, **kwargs):
             self.format = format
         else:
             raise Exception("Unsupported format")
-        super(InstagramAPI, self).__init__(*args, **kwargs)
+        super(InstagramAPI, self).__init__(**kwargs)
 
     media_popular = bind_method(
                 path="/media/popular",

instagram/oauth2.py

@@ -1,8 +1,10 @@
 from .json_import import simplejson
 from six.moves.urllib.parse import urlencode
 from httplib2 import Http
+from hashlib import sha256
 import mimetypes
 import six
+import hmac
 
 
 class OAuth2AuthExchangeError(Exception):
@@ -118,6 +120,12 @@ class OAuth2Request(object):
     def __init__(self, api):
         self.api = api
 
+    def _generate_sig(self, endpoint, params, secret):
+        sig = endpoint
+        for key in sorted(params.keys()):
+            sig += '|%s=%s' % (key, params[key])
+        return  hmac.new(secret, sig, sha256).hexdigest()
+
     def url_for_get(self, path, parameters):
         return self._full_url_with_params(path, parameters)
 
@@ -127,15 +135,18 @@ def get_request(self, path, **kwargs):
     def post_request(self, path, **kwargs):
         return self.make_request(self.prepare_request("POST", path, kwargs))
 
-    def _full_url(self, path, include_secret=False):
-        return "%s://%s%s%s%s" % (self.api.protocol,
+    def _full_url(self, path, include_secret=False, include_signed_request=True):
+        return "%s://%s%s%s%s%s" % (self.api.protocol,
                                   self.api.host,
                                   self.api.base_path,
                                   path,
-                                  self._auth_query(include_secret))
+                                  self._auth_query(include_secret),
+                                  self._signed_request(path, {}, include_signed_request, include_secret))
 
-    def _full_url_with_params(self, path, params, include_secret=False):
-        return (self._full_url(path, include_secret) + self._full_query_with_params(params))
+    def _full_url_with_params(self, path, params, include_secret=False, include_signed_request=True):
+        return (self._full_url(path, include_secret) + 
+                self._full_query_with_params(params) +
+                self._signed_request(path, params, include_signed_request, include_secret))
 
     def _full_query_with_params(self, params):
         params = ("&" + urlencode(params)) if params else ""
@@ -150,6 +161,18 @@ def _auth_query(self, include_secret=False):
                 base += "&client_secret=%s" % (self.api.client_secret)
             return base
 
+    def _signed_request(self, path, params, include_signed_request, include_secret):
+        if include_signed_request:
+            if self.api.access_token:
+                params['access_token'] = self.api.access_token
+            elif self.api.client_id:
+                params['client_id'] = self.api.client_id
+            if include_secret and self.api.client_secret:
+                params['client_secret'] = self.api.client_secret
+            return "&sig=%s" % self._generate_sig(path, params, self.api.client_secret)
+        else:
+            return ''
+
     def _post_body(self, params):
         return urlencode(params)
 

sample_app.py

@@ -64,9 +64,8 @@ def on_callback():
         access_token, user_info = unauthenticated_api.exchange_code_for_access_token(code)
         if not access_token:
             return 'Could not get access token'
-        api = client.InstagramAPI(access_token=access_token)
+        api = client.InstagramAPI(access_token=access_token, client_secret=CONFIG['client_secret'])
         request.session['access_token'] = access_token
-        print ("access token="+access_token)
     except Exception as e:
         print(e)
     return get_nav()
@@ -78,7 +77,7 @@ def on_recent():
     if not access_token:
         return 'Missing Access Token'
     try:
-        api = client.InstagramAPI(access_token=access_token)
+        api = client.InstagramAPI(access_token=access_token, client_secret=CONFIG['client_secret'])
         recent_media, next = api.user_recent_media()
         photos = []
         for media in recent_media:
@@ -87,7 +86,6 @@ def on_recent():
                 photos.append('<video controls width height="150"><source type="video/mp4" src="%s"/></video>' % (media.get_standard_resolution_url()))
             else:
                 photos.append('<img src="%s"/>' % (media.get_low_resolution_url()))
-            print(media)
             photos.append("<br/> <a href='/media_like/%s'>Like</a>  <a href='/media_unlike/%s'>Un-Like</a>  LikesCount=%s</div>" % (media.id,media.id,media.like_count))
         content += ''.join(photos)
     except Exception as e:
@@ -97,14 +95,14 @@ def on_recent():
 @route('/media_like/<id>')
 def media_like(id): 
     access_token = request.session['access_token']
-    api = client.InstagramAPI(access_token=access_token)
+    api = client.InstagramAPI(access_token=access_token, client_secret=CONFIG['client_secret'])
     api.like_media(media_id=id)
     redirect("/recent")
 
 @route('/media_unlike/<id>')
 def media_unlike(id): 
     access_token = request.session['access_token']
-    api = client.InstagramAPI(access_token=access_token)
+    api = client.InstagramAPI(access_token=access_token, client_secret=CONFIG['client_secret'])
     api.unlike_media(media_id=id)
     redirect("/recent")
 
@@ -115,7 +113,7 @@ def on_user_media_feed():
     if not access_token:
         return 'Missing Access Token'
     try:
-        api = client.InstagramAPI(access_token=access_token)
+        api = client.InstagramAPI(access_token=access_token, client_secret=CONFIG['client_secret'])
         media_feed, next = api.user_media_feed()
         photos = []
         for media in media_feed:
@@ -138,7 +136,7 @@ def location_recent_media():
     if not access_token:
         return 'Missing Access Token'
     try:
-        api = client.InstagramAPI(access_token=access_token)
+        api = client.InstagramAPI(access_token=access_token, client_secret=CONFIG['client_secret'])
         recent_media, next = api.location_recent_media(location_id=514276)
         photos = []
         for media in recent_media:
@@ -155,7 +153,7 @@ def media_search():
     if not access_token:
         return 'Missing Access Token'
     try:
-        api = client.InstagramAPI(access_token=access_token)
+        api = client.InstagramAPI(access_token=access_token, client_secret=CONFIG['client_secret'])
         media_search = api.media_search(lat="37.7808851",lng="-122.3948632",distance=1000)
         photos = []
         for media in media_search:
@@ -172,7 +170,7 @@ def media_popular():
     if not access_token:
         return 'Missing Access Token'
     try:
-        api = client.InstagramAPI(access_token=access_token)
+        api = client.InstagramAPI(access_token=access_token, client_secret=CONFIG['client_secret'])
         media_search = api.media_popular()
         photos = []
         for media in media_search:
@@ -189,7 +187,7 @@ def user_search():
     if not access_token:
         return 'Missing Access Token'
     try:
-        api = client.InstagramAPI(access_token=access_token)
+        api = client.InstagramAPI(access_token=access_token, client_secret=CONFIG['client_secret'])
         user_search = api.user_search(q="Instagram")
         users = []
         for user in user_search:
@@ -206,7 +204,7 @@ def user_follows():
     if not access_token:
         return 'Missing Access Token'
     try:
-        api = client.InstagramAPI(access_token=access_token)
+        api = client.InstagramAPI(access_token=access_token, client_secret=CONFIG['client_secret'])
         # 25025320 is http://instagram.com/instagram
         user_follows, next = api.user_follows('25025320')
         users = []
@@ -228,7 +226,7 @@ def location_search():
     if not access_token:
         return 'Missing Access Token'
     try:
-        api = client.InstagramAPI(access_token=access_token)
+        api = client.InstagramAPI(access_token=access_token, client_secret=CONFIG['client_secret'])
         location_search = api.location_search(lat="37.7808851",lng="-122.3948632",distance=1000)
         locations = []
         for location in location_search:
@@ -245,8 +243,8 @@ def tag_search():
     if not access_token:
         return 'Missing Access Token'
     try:
-        api = client.InstagramAPI(access_token=access_token)
-        tag_search, next_tag = api.tag_search(q="catband")
+        api = client.InstagramAPI(access_token=access_token, client_secret=CONFIG['client_secret'])
+        tag_search, next_tag = api.tag_search(q="backclimateaction")
         tag_recent_media, next = api.tag_recent_media(tag_name=tag_search[0].name)
         photos = []
         for tag_media in tag_recent_media: