Closed odigity closed 1 year ago
I hope this is helpful - and I hope it did it correctly. (I haven't done much contributing to FOSS.)
BTW - I just discovered this package a couple hours ago, and am still reading through the docs. I just noticed this bit:
@auth.verify_password
def verify_password(username, password):
if username in users and \
check_password_hash(users.get(username), password):
return username
...
"...the function should return the user object."
(ref: https://flask-httpauth.readthedocs.io/en/latest/#basic-authentication-examples)
The docs say to return a User object, but the example demonstrates returning a username - and later in the same example, current_user()
is called, which is supposed to return the User object that was returned from verify_password
, but it's just a username...
Is this an error in the docs? I can fix it in the same PR... in fact, if you like, we can leave this PR open until I've finished reading all the docs in case I spot any other opportunities for improvement.
Another possible issue at: https://flask-httpauth.readthedocs.io/en/latest/#flask_httpauth.HTTPBasicAuth.get_password
The get_password
method is marked deprecated, but is still used in the Digest Auth example.
The docs say to return a User object
This package does not care how you represent your users. Whatever you return is what you are going to get when you call current_user()
. A string is an acceptable "User object" for simple applications.
The get_password method is marked deprecated, but is still used in the Digest Auth example.
The get_password()
method is deprecated for Basic auth. It is not deprecated for Digest auth.
Thanks!