Trying to understand the oauth2 scope and how security works about connexion-example

[hjacobs]

By setting the environment variable HTTP_TOKENINFO_URL (or x-tokenInfoUrl on the security definition) you will simply enable the security decorator which will request the given HTTP URL with an access_token parameter filled with the Bearer token (https://github.com/zalando/connexion/blob/master/connexion/decorators/security.py#L64) and extracts the JSON response. The JSON response must contain the fields scope and uid (e.g. username).

I'm not familiar with standard security mechanisms in Flask, but you can always simply decorate your function with a custom function to do security checking. You can find a simple example here: http://flask.pocoo.org/snippets/8/

[hjacobs]

@KarimJedda I added a very simple example of HTTP Basic Auth here: https://github.com/zalando/connexion/tree/master/examples/basicauth

[hjacobs]

@KarimJedda I also added a simple OAuth2 resource server example with a mock token info endpoint: https://github.com/zalando/connexion/tree/master/examples/oauth2

[hjacobs]

@KarimJedda obviously I would like to see your published blog post 😄

Don't hesitate to ask/contact if you need any further support. Thanks!

[KarimJedda]

Wow @hjacobs, I wasn't expecting such a wonderful and detailled answer, thanks a lot !!! I will try it out right away. Really man you're doing some awesome job with this!
Sure thing, you'll be the first to know when it's done ;)
thanks again!!