在Flask中存储没有数据库的Oauth2 access_token

Question

I'm working with the imgur api . I'm using Flask without a db.

I'm trying to access a single dedicated account, so there won't be more than one user account in this app (thus i just have to manually authorize it once and do the rest with the tokens the service gives to me , no need for a database). Once authorized the app on the account, Imgur gives me two tokens: an access_token that expires after an hour and a refresh_token that doesn't expire and can be used to request a new access_token.

I can't think any method different that this to send correct requests to the server using this two tokens and refreshing the access one only when needed:

from flask import Flask
from foobar import foo, bar
import config

app = Flask(__name__)
app.config.from_object(config)

#I initialize the access_token with the value hardcoded in the config file
access_token = config.access_token

@app.route('/',methods=['POST'])
def home():

    #I access the value i initialized when starting the server
    global access_token

    if request.method == 'POST':

       #I send the access_token to a method that contacts Imgur servers and checks if it's still valid. If not it will request and return a new one.
       access_token = foo(access_token)

       #I send the token, now sure it's always a valid one, to the rest of the logic that uses it to do actual requests
       bar(access_token)

This works. As long i don't restart the server it will require a new access_token only if needed, but it doesn't really look a good way of doing things. The idea of hardcoding a token that expires in an hour sounds really silly and i don't really know if using that global variable there could be a good practice nor if it would be reinitialized from the config file in some scenario i'm currently ignoring. How can i avoid this? I should write the new refreshed access_token on a file and load it from there in the config? Does that create security concerns?

Also, the refresh_token doesn't expire so i think there is no problem on storing it in the cofing file, but sill every time i request an access_token it also gives me a new refresh_token, should i update that too? It seems unnecessary, the old one still works, but maybe i'm missing something.

Answer 1

According to imgur's API doc, access_token expires after one month not after one hour. I think it's acceptable method to store it in a file. You are already storing the refresh_token in the config file, so if an attacker can access the app's directory, it does not matter whether access_token is also there. (Of course you should run the Flask app as a separate user, and all files should be accessible only by that user.)

You can also store the expire date along with the access_token , so you can check whether you have the renew it before a request.