0

How can I limit access to a route by using custom decorators? Or is there a better and simple way to this?

Below is the code to reset forget password:

@auth.route('/reset', methods=['GET', 'POST'])
def password_reset_verify():
    if not current_user.is_anonymous():
        return redirect(url_for('main.index'))
    form = PasswordResetVerifyForm()
    if form.validate_on_submit():
        return redirect(url_for('auth.password_reset', uid=form.uid.data))
    return render_template('auth/reset.html', form=form)

I don't want others to access this route until they have verified the above route. Since you can change others password by doing /reset/123456789

@auth.route('/reset/<uid>', methods=['GET', 'POST'])
def password_reset(uid):
    if not current_user.is_anonymous():
        return redirect(url_for('main.index'))
    form = PasswordResetForm()
    if form.validate_on_submit():
        user = User.query.filter_by(uid=uid).first()
        if user is None:
            return redirect(url_for('main.index'))
        if user.reset_password(form.password.data):
            flash('Your password has been updated.')
            return redirect(url_for('auth.login'))
        else:
            return redirect(url_for('main.index'))
    return render_template('auth/reset.html', form=form)

How can I write my custom decorator so that guests have to no permissions to get in to password_rest route. In another word, password_rest route is an one time access to that verify only. Or is there a way that I can combine password_rest into password_rest_verify?

6
  • What flask libraries are you using here? I know flask.ext.login has a really simple decorator for this. Aug 10, 2014 at 23:47
  • 2
    You shouldn't include the <uid> in the route. I assume you know the user is logged in and can therefor retrieve their uid from the session object. After they validate their password, you set an additional session value password_reset_verified = True or similar, then on the password_reset function you check that it is set, reset their password, and clear the value from the session. In fact I see you are accessing current_user so you can just get the uid from there. Never trust users.
    – sberry
    Aug 10, 2014 at 23:55
  • This is poor security, as stated by @sberry you would never actually use a uid to reset a password...Assign a unique token, send the email and ask the user to confirm through the email (of course this means that emails are also verified during registration).
    – petkostas
    Aug 11, 2014 at 0:00
  • @sberry No, logged in user can never access password rest page, there's another route to change password for logged in users. I retrieve their uid from previous PasswordResetVerifyForm from and get the uid value pass to password_reset(uid) for user query.
    – Ricek
    Aug 11, 2014 at 15:41
  • @petkostas Yes, I do realize that this is poor security. I do not have the flask-email set up, I want user to be able reset their password at the site instead going to email and click on a link. Maybe I'll generate an unique token to replace <uid>
    – Ricek
    Aug 11, 2014 at 15:43

1 Answer 1

0

So I used itsdangerous to generates token

generate_reset_token method generates a token with a default validity of time. reset_password function checks that the id from the token matches the verified user.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.