Flask-security: REST authentication ?

[asmodehn]

Is there a way that I can implement a REST API to be able to authenticate users using flask security ?

From what I could gather from the documentation around, flask-login and flask-security seems to aim at securing websites, however I need to build a REST authentication service ( and an "internal API" for other services to check that users are authenticated ) and I would obviously like to avoid reimplementing everything...

How/where should I plug my API to reuse a maximum of flask-security while not using the templates ? By any chance, is there any project already doing this that you are aware of ?

=> It seems we could have two main parts in flask-security :

• the templates and mechanisms for login/password & sessions handling that people use for securing website.
• the backend integration and authentication/authorization mechanism that can also be used by people wanting to implement authentication REST services.

Thanks for letting me know how you would go about doing this, I ll probably start on it sometime soon...

[fuhrysteve]

So are you looking for a sort of stateless authentication with flask security? Check out login_manager.request_loader. This is technically part of flask-login (a dependency of flask-security), which may be why you had trouble finding direction in the flask-security docs

https://flask-login.readthedocs.org/en/latest/#custom-login-using-request-loader

Here's how you might implement this functionality using flask-security

user_datastore = SQLAlchemyUserDatastore(db, User, Role)
security = Security(app, user_datastore)

@security.login_manager.request_loader
def load_user_from_request(req):
    api_key = req.args.get('api_key', req.headers.get('Authorization'))
    # retrieve and return a user object

[davvid]

I'm using flask-security and I find that I am able to authenticate using flask-security by setting the content-type to application/json and issuing regular json requests.

The only difficulty you might encounter is the need to provide csrf tokens for flask-wtf. The changes in my PR makes that possible.

Flask-Security expects an Authentication-Token header with the value from the user token provided from the login endpoint when using its auth_required decorator. Post credentials to the login endpoint and you'll get back the user's token. That token can be used to access views protected with auth_required('session', 'token').

[asmodehn]

Thanks everyone for the useful feedback.
I haven't been able to start working on it yet, but I thought I should explain more what I am trying to do here...

I am currently in the process of building a set of microservices, REST based, one service for one purpose. I haven't started the authentication / authorization part yet.

An Authentication microservice could be quite generic and could be already out there somewhere ( how about https://github.com/LukeB42/microauth ? ).
But to verify that a user is authenticated in all other services, there must be some non-trivial flow of information exchange ( not only "check the DB" but more like "move around the token to the proper service at the proper time" ), and there are multiple possible solution.

Ideally, I would love to find :
1) a (flask based) microservice that only cares about authentication
2) a (flask based) library that ensures a user is authenticated ( coupled with the authentication microservice ). This library can be plugged in in any other microservice that want to rely on the authentication mechanism provided by 1)

From my far away perspective ( since I am not deeply involved in how to do web auth yet ), I am thinking that flask-security can be the library in 2), and that there should be 1) somewhere ( potentially also using flask-security ) that I just need to grab, and "plug and play".

I hope this makes my intention clearer.

[fuhrysteve]

@asmodehn hmm, it seems like Flask-Login would fulfill your requirements. Flask-Security provides a lot of overhead you didn't really mention you're interested in, such as registration, email confirmations, password resets, password encryption utilities, user roles, etc.