Addition of NMOS OAuth security decorators

bbc / nmos-query

AMWA NMOS IS-04 Query API Service

Apache License 2.0

3 stars 2 forks source link

Addition of NMOS OAuth security decorators #30

Closed dannymeloy closed 5 years ago

dannymeloy commented 5 years ago

Will protect subscription and web socket endpoints from unauthorized access when the OAUTH_MODE flag in nmoscommon-config is Truthy (default is set to False.)

Also changed imports to explicit relative in line with Python best practices (and so I could run it without installing it initially...)

simonrankine commented 5 years ago

General point - if where you can you can do large linting fixes in one stand-alone commit it would make it easier to see the main changes for the PR ;-)

simonrankine commented 5 years ago

General point - do we want to protect all of the endpoints in IS-04, so that baddies can't scrape out information about what's on the network? I thought that was the plan but maybe I didn't communicate that well.

dannymeloy commented 5 years ago

I think long term we would probably have everything secured yes, I think this was more of a proof of concept that I could get it working with websockets and limit access to them if a token wasn't present

andrewbonney commented 5 years ago

A minor thing, but this may be best as a minor version bump rather than a patch.

dannymeloy commented 5 years ago

Closing because merge conflicts were resolved in difference branch #35