Authentication - where, what, how?

[simonrolph]

For GET/POST requests from indicia (or other service) to the API see this from chatgpt:

You can use a Python decorator to handle authentication for your Flask routes in a clean and reusable way. A decorator allows you to apply the same authentication logic across multiple routes without repeating code.

1. Create the Authentication Decorator

• The decorator will check for the presence of a valid token in the request headers before allowing access to the route.

2. Apply the Decorator to Your Routes

• Use the @auth_required decorator on any route that requires authentication.

Example Implementation

from functools import wraps
from flask import Flask, request, jsonify

app = Flask(__name__)

# A dictionary to store tokens for simplicity. In a production environment, store these in a database.
VALID_TOKENS = {
    "service1": "your_token_for_service1",
    "service2": "your_token_for_service2",
    # Add more tokens for other services
}

def check_auth(token):
    """Check if the token is valid."""
    return token in VALID_TOKENS.values()

def auth_required(f):
    @wraps(f)
    def decorated_function(*args, **kwargs):
        auth_header = request.headers.get('Authorization')

        if not auth_header:
            return jsonify({"message": "Missing token"}), 401

        # The token is usually sent as "Bearer <token>"
        try:
            token = auth_header.split(" ")[1]
        except IndexError:
            return jsonify({"message": "Invalid token format"}), 401

        # Validate the token
        if not check_auth(token):
            return jsonify({"message": "Unauthorized"}), 401

        # If the token is valid, proceed with the original function
        return f(*args, **kwargs)

    return decorated_function

@app.route('/your_api_endpoint', methods=['POST'])
@auth_required
def your_api_function():
    # Your API logic here
    data = request.json
    return jsonify({"message": "Data received", "data": data}), 200

@app.route('/another_endpoint', methods=['POST'])
@auth_required
def another_api_function():
    # Logic for another endpoint
    data = request.json
    return jsonify({"message": "Another endpoint hit", "data": data}), 200

if __name__ == '__main__':
    app.run(debug=True)

Explanation:

1. check_auth Function:

   • This function verifies if the provided token is valid by checking it against a dictionary of valid tokens.

2. auth_required Decorator:

   • The auth_required decorator wraps your route functions. It checks for the presence of an Authorization header and validates the token.
   • If the token is missing, incorrectly formatted, or invalid, it returns a 401 Unauthorized response.
   • If the token is valid, it proceeds to execute the original route function.

3. Applying the Decorator:

   • The @auth_required decorator is applied to any route that requires token-based authentication. This ensures that the route is protected, and only requests with a valid token can access it.

Usage:

• When an external service wants to make a POST request to /your_api_endpoint, it must include the Authorization header with a valid token, like so:

  Authorization: Bearer your_token_for_service1

• If the token is valid, the route function is executed, and the request is processed normally. Otherwise, a 401 Unauthorized response is returned.

This approach keeps your authentication logic centralized and reusable, making your codebase cleaner and easier to maintain.