Flask：如何在会话中存储凭据并检索它们？

Question

I am working on a project where each of my REST endpoints needs to be authenticated. An example is

@login_required
def get_transactions(self):
  pass

I have a User model which looks like

class User(UserMixin, db.Model):
    __tablename__ = 'users'
    # noinspection PyShadowingBuiltins
    uuid = Column('uuid', GUID(), default=uuid.uuid4, primary_key=True,
                  unique=True)
    email = Column('email', String, nullable=False, unique=True)
    _password = Column('password', String, nullable=False)
    created_on = Column('created_on', sa.types.DateTime(timezone=True),
                        default=datetime.utcnow(), nullable=False)
    last_login = Column('last_login', sa.types.DateTime(timezone=True),
                        onupdate=datetime.utcnow())

    def __init__(self, email, password):
        self.email = email
        self._password = hash_password(password) # hash_password does md5 of password

• Once the user is logged in I want to store a security token on client session and would like each further request to have that token
• I looked for examples, but did not understand how I can save such a security token in client session PLUS
• How can I make sure that further requests send me that token from client session.

I do not know how that works, please help

Answer 1

Have you seen this example? http://flask.pocoo.org/docs/patterns/viewdecorators/?highlight=login_required

Also modules like these if you don't feel like rewriting the thing yourself:

• http://pythonhosted.org/Flask-Login/
• http://pythonhosted.org/Flask-Auth/

Anyway, as for storing the data in the session, that should be fairly easy. Simply put it in flask.session:

import flask
# You want to automatically generate the token and store it somewhere on the server (database for example)
flask.session['some_token'] = some_token

Your token could be something like this:

class Session(db.Model):
    token = Column('token') # auto generated thingy
    # foreign key to user for example
    # expiration time/date

Answer 2

There is no way for a server to make REST clients accept and return cookies. Web browsers will do it under certain conditions when the user logs in manually, but unless your service is accessed only by interactive web applications hosted in the same domain and every user has an account on your service, you might as well forget this approach. (Even CORS won't help for browsers/users that refuse cross-domain cookies.)

The most common solution is requiring the REST client to send its credentials in every request, often using standard http auth headers, and securing the transmission with https.

OAuth/OAuth2 can be useful here if you want to separate authentication from authorization, at the expense of simplicity.