3 ms·

Token auth in flask is something I was going to work on soon. It should be straightforward to use a decorator to protect restricted pages. One thing I am absolu

by kfk 13y ago

Token auth in flask is something I was going to work on soon. It should be straightforward to use a decorator to protect restricted pages. One thing I am absolutely not clear yet is how you keep the user logged if the token expires after x seconds. I mean, if the user is using the app, somehow the token expiring date should be constantly updated, right? All this would be amazing coupled with angularjs… Edit Oh, and I join the question: what about flask-restful?

tomchristie 13y ago
> It should be straightforward to use a decorator to protect restricted pages. Authentication policies will use a similar style to the renderers and parsers (and all of REST framework). You'll be able to set them per-view with a decorator, or set them system-wide in the config. You'll also be able to support multiple authentication policies.
- lukasm 13y ago
  Long story short - I went full hipster on that grunt + yeoman + bower + angular ui and my conclusion is http://i3.kym-cdn.com/photos/images/newsfeed/000/439/835/47c.jpg http://i3.kym-cdn.com/photos/images/newsfeed/000/439/835/47c... Too much complexity added to project. Going REST patch is problematic when you have to integrate with with server-render style lib or service. SEO is shit. Angular doc is worse. Auth is base on tokens, no sessions. I reused the ideas from here https://github.com/mrgamer/angular-login-example https://github.com/mrgamer/angular-login-example def auth_required(f): @wraps(f) def wrapper(args, *kwargs): token = request.headers.get("X-Token") if token is None: abort(400) user = User.verify_auth_token(token, app.config["SECRET_KEY"]) If you don't make very heavy SPA like photoshop, don't use angular.
hughes 13y ago
I use Miguel Grinberg's "Token Based Authentication" example[1]. It's based on itsdangerous's TimedJSONWebSignatureSerializer class and it works very well in practice. [1] http://blog.miguelgrinberg.com/post/restful-authentication-with-flask http://blog.miguelgrinberg.com/post/restful-authentication-w...

by kfk 13y ago

tomchristie 13y ago

> It should be straightforward to use a decorator to protect restricted pages. Authentication policies will use a similar style to the renderers and parsers (and all of REST framework). You'll be able to set them per-view with a decorator, or set them system-wide in the config. You'll also be able to support multiple authentication policies.

lukasm 13y ago
Long story short - I went full hipster on that grunt + yeoman + bower + angular ui and my conclusion is http://i3.kym-cdn.com/photos/images/newsfeed/000/439/835/47c.jpg http://i3.kym-cdn.com/photos/images/newsfeed/000/439/835/47c... Too much complexity added to project. Going REST patch is problematic when you have to integrate with with server-render style lib or service. SEO is shit. Angular doc is worse. Auth is base on tokens, no sessions. I reused the ideas from here https://github.com/mrgamer/angular-login-example https://github.com/mrgamer/angular-login-example def auth_required(f): @wraps(f) def wrapper(args, *kwargs): token = request.headers.get("X-Token") if token is None: abort(400) user = User.verify_auth_token(token, app.config["SECRET_KEY"]) If you don't make very heavy SPA like photoshop, don't use angular.

hughes 13y ago

I use Miguel Grinberg's "Token Based Authentication" example[1]. It's based on itsdangerous's TimedJSONWebSignatureSerializer class and it works very well in practice. [1] http://blog.miguelgrinberg.com/post/restful-authentication-with-flask http://blog.miguelgrinberg.com/post/restful-authentication-w...