CODEWITHSUNDEEP
pythonpython-3.xauthenticationflaskpython-3.6
nolwww
nolwww

Reputation: 1715

Request validation based on header in Flask framework

I have several endpoints that I built with Flask. Some of the endpoints should approve requests only for some specific user ids.

Let's say I have:

  1. This endpoint: company//videos to GET all videos for this company.
  2. A header containing the user id of the user making the GET request.
  3. A mongo collection containing all user ids and the corresponding companies the said user can access.

What is the best way, with Flask, to check if the request can be approved given the corresponding header?

Edit: While there are some good Flask decorators to handle it when we use an ORM with an User table, like here: https://pypi.org/project/Flask-Authorize/ , in my case, I'm not using any ORM

Upvotes: 2

Views: 1002

Answers (1)

Kostas Livieratos
Kostas Livieratos

Reputation: 1067

If I were you, I'd build a custom decorator to control this kind of permissions.

The flow would look like this:

  1. intercept incoming request
  2. find out what's the request's user id
  3. send a query to your mongo (if not cached with ttl eg. 10sec) to retrieve the list of allowed user ids
  4. do your checks and allow or prohibit usage of endpoint

Let me know if that sounds realistic for your use-case, or if you have any questions.

Upvotes: 1

Related Questions