FlaskSimpleAuth: The Secure Flask Framework
FlaskSimpleAuth is a Flask wrapper to add a declarative security layer to routes with authentification, authorization and parameter management.
With FlaskSimpleAuth, application and security concerns are separated:
the application focusses on what to do, and declares its security requirements.
the configuration declares how the authentification and authorization constraints are checked by providing settings and hook functions.
the framework implements and enforces the security on the application routes, with safe defaults so that security cannot be overlooked.
The following Flask application provides two routes:
GET /store
allows any authenticated user in group employee to access the store list.POST /store/<sid>
allows an authenticated user who is a manager of store number sid to add a quantity of product to the store inventory.
# file "app.py"
from FlaskSimpleAuth import Flask
app = Flask("acme")
app.config.from_envvar("ACME_CONFIG")
@app.get("/store", authorize="employee")
def get_store(pattern: str = "%"):
# return the list of stores matching optional parameter pattern
return ..., 200
@app.post("/store/<sid>/product", authorize=("store", "sid", "manager"))
def post_store_sid_product(sid: int, product: str, quantity: int):
# product is added in quantity to store sid
return ..., 201
In this code, there is no clue about how users are authenticated, as this is
set from the configuration.
Only authorizations are declared on the route with the mandatory authorize
parameter.
How these are checked is also set from the configuration.
HTTP or JSON parameters are automatically converted to the expected type,
with features on par with FastAPI.
Authentication and authorizations are provided to the framework with callback functions. For our example, we will need to retrieve the salted hashed password for a user, to check whether a user belongs to a group, and to tell whether a user can access a given store in a particular role:
# file "auth.py"
def get_user_pass(user: str) -> str|None:
return ... # hashed password retrieved from somewhere
def user_is_employee(user: str) -> bool:
return ... # whether user belongs to group employee
def store_perms(user: str, sid: int, role: str) -> bool|None:
return ... # whether user can access store sid in role
Here is an example of configuration for the above application: Users are identified either with a JWT token or with a basic authentification.
# file "acme.conf"
import os
import auth
FSA_MODE = "dev"
FSA_AUTH = ["token", "basic"]
FSA_TOKEN_TYPE = "jwt"
FSA_TOKEN_SECRET = os.environ["ACME_SECRET"]
FSA_GET_USER_PASS = auth.get_user_pass
FSA_GROUP_CHECK = { "employee": auth.user_is_employee }
FSA_OBJECT_PERMS = { "store": auth.store_perms }
The framework will ensure that routes are only called by authenticated users who have the right authorizations. Secure and reasonable defaults are provided. Most features can be adjusted or extended to particular needs through numerous directives and hooks. Authentication and authorization callback invocations are cached for efficiency. Also, pydantic, dataclass and generic type parameters are supported out of the box.
More
License
This code is Public Domain.
All software has bug, this is software, hence… Beware that you may lose your hairs or your friends because of it. If you like it, feel free to send a postcard to the author.
Contents
- Introduction
- Tutorial
- Documentation
- Sample Configuration
- Recipes
- Installation
- Authentication
- How-to configure basic authentication?
- How-to configure parameter authentication?
- How-to configure token authentication?
- How to disable token authentication?
- How-to get the current user login as a string?
- How-to get the current user as an object?
- How-to store login and passwords?
- How-to implement my own authentication scheme?
- How-to test authentication and authorizations without any password?
- How-to use LDAP/AD authentication?
- How-to use multi-factor authentication (MFA)?
- How to ensure that no route is without authentication?
- How-to … authentication?
- Authorization
- Parameters
- Miscellaneous
- Versions
- TODO
- ? on ?
- 33.0 on 2024-08-16
- 32.0 on 2024-08-15
- 31.0 on 2024-08-13
- 30.3 on 2024-08-10
- 30.2 on 2024-07-31
- 30.1 on 2024-07-28
- 30.0 on 2024-03-26
- 29.5 on 2024-03-23
- 29.4 on 2024-03-23
- 29.3 on 2024-03-16
- 29.2 on 2024-03-02
- 29.1 on 2024-02-25
- 29.0 on 2024-02-23
- 28.6 on 2024-02-18
- 28.5 on 2024-02-08
- 28.4 on 2024-02-07
- 28.3 on 2024-02-03
- 28.2 on 2024-01-21
- 28.1 on 2024-01-21
- 28.0 on 2024-01-07
- 27.6 on 2024-01-07
- 27.5 on 2024-01-07
- 27.4 on 2024-01-06
- 27.3 on 2024-01-06
- 27.2 on 2024-01-05
- 27.1 on 2024-01-05
- 27.0 on 2023-12-09
- 26.0 on 2023-11-30
- 25.3 on 2023-11-19
- 25.2 on 2023-10-01
- 25.1 on 2023-08-27
- 25.0 on 2023-08-22
- 24.0 on 2023-07-28
- 23.2 on 2023-07-23
- 23.1 on 2023-07-13
- 23.0 on 2023-06-14
- 22.0 on 2023-03-12
- 21.5 on 2023-02-05
- 21.4 on 2023-02-05
- 21.3 on 2023-02-04
- 21.2 on 2023-02-02
- 21.1 on 2023-01-31
- 21.0 on 2023-01-29
- 20.11 on 2023-01-26
- 20.10 on 2023-01-15
- 20.9 on 2023-01-14
- 20.8 on 2023-01-14
- 20.7 on 2023-01-14
- 20.6 on 2023-01-13
- 20.5 on 2023-01-11
- 20.4 on 2023-01-07
- 20.3 on 2023-01-02
- 20.2 on 2022-12-27
- 20.1 on 2022-12-24
- 20.0 on 2022-12-22
- 19.3 on 2022-12-06
- 19.2 on 2022-12-06
- 19.1 on 2022-12-05
- 19.0 on 2022-11-16
- 18.1 on 2022-11-11
- 18.0 on 2022-11-07
- 17.0 on 2022-10-29
- 16.0 on 2022-10-27
- 15.0 on 2022-09-11
- 14.2 on 2022-08-02
- 14.1 on 2022-08-02
- 14.0 on 2022-08-02
- 13.0 on 2022-06-12
- 12.0 on 2022-05-30
- 11.0 on 2022-05-27
- 10.0 on 2022-03-06
- 9.0 on 2022-03-04
- 8.0 on 2022-03-04
- 7.0 on 2022-02-24
- 6.0 on 2022-02-13
- 5.4.0 on 2022-02-08
- 5.3.0 on 2022-02-04
- 5.2.0 on 2022-01-31
- 5.1.0 on 2022-01-30
- 5.0.0 on 2022-01-29
- 4.7.1 on 2022-01-16
- 4.7.0 on 2022-01-16
- 4.6.3 on 2022-01-12
- 4.6.2 on 2021-12-26
- 4.6.1 on 2021-12-24
- 4.6.0 on 2021-12-19
- 4.5.1 on 2021-12-12
- 4.5.0 on 2021-12-12
- 4.4.0 on 2021-12-11
- 4.3.1 on 2021-12-05
- 4.3.0 on 2021-10-14
- 4.2.0 on 2021-09-14
- 4.1.0 on 2021-06-12
- 4.0.0 on 2021-06-01
- 3.1.1 on 2021-05-31
- 3.1.0 on 2021-04-17
- 3.0.0 on 2021-04-07
- 2.5.0 on 2021-04-04
- 2.4.1 on 2021-03-29
- 2.4.0 on 2021-03-29
- 2.3.0 on 2021-03-27
- 2.2.1 on 2021-03-22
- 2.2.0 on 2021-03-22
- 2.1.0 on 2021-03-21
- 2.0.0 on 2021-03-16
- 1.9.0 on 2021-03-10
- 1.8.1 on 2021-03-02
- 1.8.0 on 2021-03-02
- 1.7.0 on 2021-03-01
- 1.6.0 on 2021-02-28
- 1.5.0 on 2021-02-27
- 1.4.0 on 2021-02-23
- 1.3.0 on 2021-02-23
- 1.2.0 on 2021-02-22
- 1.1.0 on 2021-02-22
- 1.0.0 on 2021-02-21
- 0.9.0 on 2021-02-21
- API Reference