Send Images through HTTPS Authorization

[marsmith]

Hello-

I'm trying to set up a sample flask web service to accept images from my Axis camera using an HTTPS recipient. I would expect that the Username/Password I filled out in the Recipient form would be transmitted as an Authorization header in the POST request, but that does not happen. In fact it does not seem like the Username/Password come through in the request at all. I have tested the request with the Username/Password fields blank and it seems to make no difference to the request. I am trying to use the Username and Password to uniquely identify this camera request. Please see attached screenshots.

[github-actions[bot]]

This automatically generated reply acts as a friendly reminder.

Answers to your questions will most often come from the community, from developers like yourself. You will, from time to time, find that Axis employees answers some of the questions, but this is not a guarantee. Think of the discussion forum as a complement to other support channels, not a replacement to any of them.

If your question remains unanswered for a period of time, please revisit it to see whether it can be improved by following the guidelines listed in Axis support guidelines.

[vivekatoffice]

HI @marsmith ,
From my previous experiences, I understand that "Username" and "Password" are used. But I was not able to get these values using Mockoon or the PHP code (324)

Regarding: I am trying to use the Username and Password to uniquely identify this camera request.

You can use the unique identifier here and parse the filename:

[marsmith]

@vivekatoffice Great suggestion, but I would still like to transmit a password/passphrase with the request (along with a unique identifier). It seems odd to me there would be username/password field that are not used at all.

I have also submitted a support ticket on this issue. Hopefully I will hear something back there. I appreciate your input.

[vivekatoffice]

Hi @marsmith ,
I have used the following Python code and found that Axis camera sends the images and test request using Basic Authentication:

Install uvicorn to start FastAPI server

pip install uvicorn

app.py (Run using python app.py or uvicorn main:app --host 0.0.0.0 --port 8000)

from fastapi import FastAPI, HTTPException, Depends, Request
from fastapi.security import HTTPBasic, HTTPBasicCredentials
from fastapi.responses import JSONResponse
from starlette.status import HTTP_401_UNAUTHORIZED
import os

app = FastAPI()

security = HTTPBasic()

# Hardcoded credentials
USER_DATA = {
    "root": "pass"
}

UPLOAD_FOLDER = 'uploads'
os.makedirs(UPLOAD_FOLDER, exist_ok=True)

def get_current_username(credentials: HTTPBasicCredentials = Depends(security)):    
    correct_username = credentials.username in USER_DATA
    correct_password = correct_username and USER_DATA[credentials.username] == credentials.password
    print("Username received from Axis Camera:",credentials.username)
    print("Password received from Axis Camera:",credentials.password)
    if not (correct_username and correct_password):
        raise HTTPException(
            status_code=HTTP_401_UNAUTHORIZED,
            detail="Incorrect username or password",
            headers={"WWW-Authenticate": "Basic"},
        )
    return credentials.username

@app.get("/upload")
async def get_upload_file(
    username: str = Depends(get_current_username)
):
    return JSONResponse(content={"message": "This is get method"}, status_code=200)

@app.post("/upload")
async def post_upload_file(request: Request, username: str = Depends(get_current_username)):
    # Save file to local directory
    return JSONResponse(
        content={"message": "File uploaded successfully"},
        status_code=200
    )

if __name__ == "__main__":
    import uvicorn
    uvicorn.run(app, host="0.0.0.0", port=8000)

Outputs:

[vivekatoffice]

With saving image on the local drive using the Filename from "Content-Disposition"*

from fastapi import FastAPI, HTTPException, Depends, Request
from fastapi.security import HTTPBasic, HTTPBasicCredentials
from fastapi.responses import JSONResponse
from starlette.status import HTTP_401_UNAUTHORIZED
import os
from PIL import Image
import time
from email.header import decode_header
import re

app = FastAPI()

security = HTTPBasic()

# Hardcoded credentials
USER_DATA = {
    "root": "pass"
}

UPLOAD_FOLDER = 'uploads'
os.makedirs(UPLOAD_FOLDER, exist_ok=True)

def get_current_username(credentials: HTTPBasicCredentials = Depends(security)):    
    correct_username = credentials.username in USER_DATA
    correct_password = correct_username and USER_DATA[credentials.username] == credentials.password
    print("Username received from Axis Camera:",credentials.username)
    print("Password received from Axis Camera:",credentials.password)
    if not (correct_username and correct_password):
        raise HTTPException(
            status_code=HTTP_401_UNAUTHORIZED,
            detail="Incorrect username or password",
            headers={"WWW-Authenticate": "Basic"},
        )
    return credentials.username

@app.get("/upload")
async def get_upload_file(
    username: str = Depends(get_current_username)
):
    return JSONResponse(content={"message": "This is get method"}, status_code=200)

@app.post("/upload")
async def post_upload_file(request: Request, username: str = Depends(get_current_username)):
    print(username)
    # Read the body content
    body = await request.body()
    
    # Extract filename from Content-Disposition header
    content_disposition = request.headers.get("Content-Disposition")
    print(content_disposition)
    filename = None
    if content_disposition:
        match = re.search(r'filename="([^"]+)"', content_disposition)
        if match:
            filename = match.group(1)
            # Save the body content as JPEG with int64 timestamp in filename
            timestamp = int(time.time() * 1000)  # Convert current time to milliseconds
            file_location = os.path.join(UPLOAD_FOLDER, f"{filename}")
            with open(file_location, "wb") as f:
                f.write(body)
    
    if not filename:
        # Save the body content as JPEG with int64 timestamp in filename
        timestamp = int(time.time() * 1000)  # Convert current time to milliseconds
        file_location = os.path.join(UPLOAD_FOLDER, f"{filename}_{timestamp}.jpeg")
        with open(file_location, "wb") as f:
            f.write(body)
    
    
    # Check if the file is a valid image
    try:
        img = Image.open(file_location)
        img.verify()
        img.close()
    except Exception as e:
        # Delete the file if it's not a valid image
        os.remove(file_location)
        return JSONResponse(
            content={"message": "Invalid image format", "error": str(e)},
            status_code=400
        )

    return JSONResponse(
        content={"message": "Image uploaded successfully", "filename": f"{username}_{timestamp}.jpeg"},
        status_code=200
    )

if __name__ == "__main__":
    import uvicorn
    uvicorn.run(app, host="0.0.0.0", port=8000)