CSRF attack possibility? about flask-apscheduler HOT 5 CLOSED

Hi @eayin2,

I like the idea of adding HTTP authentication, maybe it could use Flask-HTTPAuth?!

e.g:

from flask_httpauth import HTTPBasicAuth

sched = APScheduler()
sched.auth = HTTPBasicAuth()
sched.init_app(app)

@sched.auth.get_password
def get_password(username):
    # get the password from database
    return ...

And to make a request:

curl -u myusername:mypassword http://localhost:5000/scheduler/jobs

If sched.auth = None so there would be no authentication

What do you think?

from flask-apscheduler.

Sounds good and with the request module an HTTP request would look like:

from requests.auth import HTTPBasicAuth
requests.get("http://localhost:5000/scheduler/jobs", auth=HTTPBasicAuth("username", "password"))

Hm, I think that should prevent any CSRF attack and we don't really need confidentiality so basic HTTP auth should suffice. Also HTTP requests to flask-apscheduler are preferably sent on the localhost.

from flask-apscheduler.

Hi @eayin2

I did a first version of authentication, it isn't using any external library.

I added an example of how to use it:
https://github.com/viniciuschiele/flask-apscheduler/blob/master/examples/auth.py#L16
https://github.com/viniciuschiele/flask-apscheduler/blob/master/examples/auth.py#L32

Authentication is disabled by default.

Let me know what you think.

from flask-apscheduler.

Just tested it and it works fine for me, thank you! :)

from flask-apscheduler.

Hi @eayin2

I've made some changes in the authentication, now there are some classes to deal with the authentication methods.

Take a look at the examples to set how to enable the HTTP basic authentication.

https://github.com/viniciuschiele/flask-apscheduler/blob/master/examples/auth.py#L18
Or
https://github.com/viniciuschiele/flask-apscheduler/blob/master/examples/auth.py#L30

from flask-apscheduler.