I have a Flask application that uses Flask-Restless to serve an API.
I just wrote some authentication that checks
- If the host provider is recognized
- The request includes a hash (calculated by encrypting the contents of the request for POST and the URL for GET together with the API secret key) and
- The hash is valid
I want to be able to write some unit tests for this, but I'm not sure how my functions use the request object. Should I make fun of the request object?
I would like to consult with this.
Config
API_CONSUMERS = [{'name': 'localhost', 'host': '12.0.0.1:5000', 'api_key': 'Ahth2ea5Ohngoop5'}, {'name': 'localhost2', 'host': '127.0.0.1:5001', 'api_key': 'Ahth2ea5Ohngoop6'}]
Authentication methods
import hashlib from flask import request def is_authenticated(app): """ Checks that the consumers host is valid, the request has a hash and the hash is the same when we excrypt the data with that hosts api key Arguments: app -- instance of the application """ consumers = app.config.get('API_CONSUMERS') host = request.host try: api_key = next(d['api_key'] for d in consumers if d['host'] == host) except StopIteration: app.logger.info('Authentication failed: Unknown Host (' + host + ')') return False if not request.headers.get('hash'): app.logger.info('Authentication failed: Missing Hash (' + host + ')') return False if request.method == 'GET': hash = calculate_hash_from_url(api_key) elif request.method == 'POST': hash = calculate_hash_from_content(api_key) if hash != request.headers.get('hash'): app.logger.info('Authentication failed: Hash Mismatch (' + host + ')') return False return True def calculate_hash_from_url(api_key): """ Calculates the hash using the url and that hosts api key Arguments: api_key -- api key for this host """ data_to_hash = request.base_url + '?' + request.query_string data_to_hash += api_key return hashlib.sha1(request_uri).hexdigest() def calculate_hash_from_content(api_key): """ Calculates the hash using the request data and that hosts api key Arguments: api_key -- api key for this host """ data_to_hash = request.data data_to_hash += api_key return hashlib.sha1(data_to_hash).hexdigest()
source share