restful安全认证
Flask-HTTPAuth是一个简单的扩展，它简化了使用Flask路由的HTTP身份验证的使用
pip install Flask-HTTPAuth
认证方式有 Basic 、Digest、token
1.Basic认证
使用HTTP基本身份验证来保护路由
from flask import Flask,jsonify
from flask_httpauth import HTTPBasicAuth
from werkzeug.security import generate_password_hash, check_password_hash
app = Flask(__name__)
auth = HTTPBasicAuth()
users = {
"aaa": generate_password_hash("123"),
"bbb": generate_password_hash("456")
}
@auth.verify_password
def verify_password(username, password):
if username in users and
check_password_hash(users.get(username), password):
return username
@app.route('/')
@auth.login_required
def index():
return "Hello, %s!" % auth.current_user()
if __name__ == "__main__":
app.run(debug=True)
测试
$ curl -i http://localhost:5000
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 19 100 19 0 0 81 0 --:--:-- --:--:-- --:--:-- 81HTTP/1.0 401 UNAUTHORIZED
Content-Type: text/html; charset=utf-8
Content-Length: 19
WWW-Authenticate: Basic realm="Authentication Required"
Server: Werkzeug/1.0.1 Python/3.6.0
Date: Mon, 23 Nov 2020 15:24:26 GMT
Unauthorized Access
使用curl时添加 -u （或 - user ）
$ curl -u aaa:123 -i http://localhost:5000
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 11 100 11 0 0 15 0 --:--:-- --:--:-- --:--:-- 15HTTP/1.0 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 11
Server: Werkzeug/1.0.1 Python/3.6.0
Date: Mon, 23 Nov 2020 15:24:44 GMT
Hello, aaa!
将验证添加到获取资源上
from flask import Flask,jsonify
from flask_httpauth import HTTPBasicAuth
from werkzeug.security import generate_password_hash, check_password_hash
app = Flask(__name__)
auth = HTTPBasicAuth()
users = {
"aaa": generate_password_hash("123"),
"bbb": generate_password_hash("456")
}
@auth.verify_password
def verify_password(username, password):
if username in users and
check_password_hash(users.get(username), password):
return username
@app.route('/')
@auth.login_required
def index():
return "Hello, %s!" % auth.current_user()
tasks = [
{
'id': 1,
'title': u'Buy groceries',
'description': u'Milk, Cheese, Pizza, Fruit, Tylenol',
'done': False
},
{
'id': 2,
'title': u'Learn Python',
'description': u'Need to find a good Python tutorial on the web',
'done': False
}
]
@app.route("/tasks", methods=['GET'])
@auth.login_required
def get_tasks():
return jsonify({'tasks': tasks})
if __name__ == "__main__":
app.run(debug=True)
测试
$ curl -i http://localhost:5000/tasks
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 19 100 19 0 0 80 0 --:--:-- --:--:-- --:--:-- 80HTTP/1.0 401 UNAUTHORIZED
Content-Type: text/html; charset=utf-8
Content-Length: 19
WWW-Authenticate: Basic realm="Authentication Required"
Server: Werkzeug/1.0.1 Python/3.6.0
Date: Mon, 23 Nov 2020 15:33:14 GMT
Unauthorized Access
Bei@DESKTOP-LCBJFJ2 MINGW64 /d/Python/dxfWrite
$ curl -u aaa:123 -i http://localhost:5000/tasks
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 317 100 317 0 0 751 0 --:--:-- --:--:-- --:--:-- 751HTTP/1.0 200 OK
Content-Type: application/json
Content-Length: 317
Server: Werkzeug/1.0.1 Python/3.6.0
Date: Mon, 23 Nov 2020 15:33:19 GMT
{
"tasks": [
{
"description": "Milk, Cheese, Pizza, Fruit, Tylenol",
"done": false,
"id": 1,
"title": "Buy groceries"
},
{
"description": "Need to find a good Python tutorial on the web",
"done": false,
"id": 2,
"title": "Learn Python"
}
]
}
2.Digest
使用HTTP摘要式身份验证
from flask import Flask,jsonify
from flask_httpauth import HTTPDigestAuth
app = Flask(__name__)
app.config['SECRET_KEY'] = 'key123456'
auth = HTTPDigestAuth()
users = {
"aaa": "123",
"bbb": "456"
}
@auth.get_password
def get_pw(username):
if username in users:
return users.get(username)
return None
@app.route('/')
@auth.login_required
def index():
return "Hello, %s!" % auth.username()
tasks = [
{
'id': 1,
'title': u'Buy groceries',
'description': u'Milk, Cheese, Pizza, Fruit, Tylenol',
'done': False
},
{
'id': 2,
'title': u'Learn Python',
'description': u'Need to find a good Python tutorial on the web',
'done': False
}
]
@app.route("/tasks", methods=['GET'])
@auth.login_required
def get_tasks():
return jsonify({'tasks': tasks})
if __name__ == "__main__":
app.run(debug=True)
测试
说明：
a.客户端访问一个受http摘要认证保护的资源
b.服务器返回401状态以及nonce等信息，要求客户端进行认证
c.客户端将以用户名，密码，nonce值，HTTP方法, 和被请求的URI为校验值基础而加密（默认为MD5算法）的摘要信息返回给服务器
d.如果认证成功，则返回相应的资源。如果认证失败，则仍返回401状态，要求重新进行认证
3.token
from flask import Flask, g,jsonify from flask_httpauth import HTTPTokenAuth app = Flask(__name__) auth = HTTPTokenAuth(scheme='Bearer') tokens = { "token1": "aaa", "token2": "bbb" } @auth.verify_token def verify_token(token): if token in tokens: return tokens[token] @app.route('/') @auth.login_required def index(): return "Hello, {}!".format(auth.current_user()) tasks = [ { 'id': 1, 'title': u'Buy groceries', 'description': u'Milk, Cheese, Pizza, Fruit, Tylenol', 'done': False }, { 'id': 2, 'title': u'Learn Python', 'description': u'Need to find a good Python tutorial on the web', 'done': False } ] @app.route("/tasks", methods=['GET']) @auth.login_required def get_tasks(): return jsonify({'tasks': tasks}) if __name__ == '__main__': app.run(debug=True)
测试
