python - Is it sure to authenticate with GitHub using requests with my username and a token generate in GitHub?

Question

I am trying to use the GitHub API to get repositories information getting it like a JSON. I use to do this, the library "requests". I want to authenticate with my account to get the rate limit 5000 request instead of 60 without authentication. The problem is that I am not sure that this solution can be secure

I am using this solution but I want to know that it is a good way to the requests or are there any better way?

url_repository = 'https://api.github.com/repos/XXXXX/YYYYY'
resp = requests.get(url=url_repository, auth=('username','token')
data = resp.json() 

I expected a secure solution.

标签： pythonsecuritygithubpython-requests

Answer 1

First, always make sure that the communication is made over https so the information will be encrypted between you and the server. The requests module operates according to the url you specify.

Second, storing the credentials in the plain text in the code is almost never a good idea. I would suggest using the builtin getpass module.

This module allows you to input the token without echoing it back to the terminal emulator nor storing it inside your code.

This does require you to enter your token every time you run your script, but that is a compromise you have to make if you wish to go for a more secured solution.

Example Code

import getpass
url_repository = 'https://api.github.com/repos/XXXXX/YYYYY'
username = getpass.getuser()
token = getpass.getpass('Token: ')
resp = requests.get(url=url_repository, auth=(username, token)
data = resp.json()