martymcguire / flask-indieauth

Allows Flask apps to require https://indieweb.org/IndieAuth authorization on routes.

• 🔭 I'm Marty McGuire
• 😄 Pronouns: he/him/his
• 🌱 I’ve got a website at martymcgui.re.
• 👯 I stream and podcast with some lovely folks.
• 💬 I enjoy organizing and building with the IndieWeb community.
• ⚡ Fun fact: my cats love quarantine.
• ✊ Black Lives Matter
• 💰 Fight povery with money
• 💸 Defund the Police

flask-indieauth's Issues

Use abort() instead of Response() for access errors

The deny() function in flask_indieauth returns a Response() object with an error message. While this does ensure the user sees an error message if they are not authenticated, I could not easily customise the response object. I recommend replacing Response() with abort(ERROR_CODE), a function that would give me control over the error response on my end.

I have downloaded the library file to my project directory and replaced the deny() function with this:

def deny(reason):
    """Sends a 400 response because token is missing or bad"""
    return abort(400)

I'd like to see this as a feature of the library itself.

Allow session authentication with the @requires_indieauth decorator

The @requires_indieauth decorator does not currently support reading access tokens from session storage. I was wondering if this is something you had considered adding to the Flask-IndieAuth extension at some point.

I am not as aware of the security ramifications of such an implementation. But, I would love to start a discussion around whether Flask-IndieAuth could add a rule that lets one authenticate if session["access_token"] is present. This would let someone view any web resource (i.e. a HTML page or a JSON file) in their browser using the Flask-IndieAuth extension.