Allow option to turn off the default 401 unauthorized basic auth prompt about flask-restful HOT 15 CLOSED

I am a little confused. The browser displays the standard username/password dialog box any time a HTTP request ends with a 401.

What would you like to happen instead?

from flask-restful.

Gah, you know what it's pretty late over here and I wasn't thinking straight. Closing this. Thanks for pointing out the obvious.

from flask-restful.

Actually it's not the 401 that triggers the browser auth dialog, but the WWW-Authenticate header from:
https://github.com/twilio/flask-restful/blob/master/flask_restful/utils/__init__.py#L16

It would be nice to have this configurable because not everyone is using HTTP Basic auth. I monkey patch this out in my app so that I can do API testing in the browser more easily.

from flask-restful.

Actually yea I think this is true -- if the auth header was removed the browser wont attempt to ask for a username/password.

from flask-restful.

In your testing, could you just override the unauthorized method with a no-op method?

I'm still a little unclear on what you actually want to configure here.

from flask-restful.

Closing because @kevinburke's fix seems simple enough and there's been no discussion on this in a month.

from flask-restful.

I've failed to see any mention in the documentation that this is the default behavior or how to change it. In my case, I don't want to send basic authentication headers to the client. I'd like to render a response with a message in it stating the client was unauthorized. Is this at all possible without having to extend the Api class?

from flask-restful.

+1 on this, I'm hitting some very odd issues because I'm trying to implement digest auth, and it's colliding with restful's basic auth header.

from flask-restful.

I would even go as far as to be able to tell Flask-Restful to not handle errors at all.

from flask-restful.

+1

from flask-restful.

+1 Very annoying when using the combining in a single flask app a restful API and a web app. May be Flask-security could have a @reject_unlogged decorator (would raise a 401 directly) in addition to @login_required (that prompt the auth form).

from flask-restful.

+1

from flask-restful.

+1

from flask-restful.

+1

from flask-restful.

For now, please try the workaround suggested by @dougblack here.

I think this will be taken care of once a better custom error handler system is implemented (see #274, #284, etc). I'd like to implement it similar to the standard flask @app.error_handler method, i.e. an @api.error_handler that accepts HTTP status codes or exceptions. It would be populated with a few defaults to keep consistent with the way it works now, but those would be easily overridable in a way that wont require you to subclass Api.

from flask-restful.