I'm trying to determine I missed something here since python isn't my native language.
- Python app starts
- Python creates a cert.pem and key.pem running this command
pem openssl req -x509 -newkey rsa:4096 -nodes -out cert.pem -keyout key.pem -days 365
- Python sets the flask secret key to a per instance generated uuid
- Flask has the ssl context set to the cert.pem and key.pem just generated
User connects to running flask app accepts the self signed cert and goes to log in. Their credentials are sent to the server using basic authentication
$.ajax({
url: '/',
method:'POST',
headers:{
"authorization": "Basic " + btoa($("#usernameinput").val() + ":" + $("#password").val())
},
success: function(res, textStatus, data) {
redirect = data.getResponseHeader('location')
if (redirect != null) {
window.location.href = redirect;
}
}
})
The server then begins the authentication process.
First it attempts to find the user in the db using a parameterized query on the user's username.
If a row is found the user row is returned. Inside that row there is a hashed password and a salt. I then take the password the user typed in and I encrypt it using sha512 and the salt from the user row in the db. If the hashed password from the db and the password provided by the user hashed with the salt from the db match, then I confirm the user is authenticated.
def log_user_in(username, password):
user = database_access.get_user_by_username(username)
if(user == None):
return 0
else:
testPasswordHash = salt_password(password,user["Salt"])
passwordsMatch = testPasswordHash == user["PasswordHash"]
if(passwordsMatch == True):
return 1
else:
return 0
If a user is authenticated, using the session
module from flask, I set the session['user'] to the username
@app.route("/", methods=['GET', 'POST'])
def home():
if request.method == 'GET':
if(check_logged_in()):
return redirect(url_for('dashboard'))
elif(useraccess.admin_user_exists() == True):
return render_template('login.html')
else:
return render_template('createadminuser.html', title="Create Admin User")
elif request.method == 'POST':
auth = request.authorization
if auth:
result = useraccess.log_user_in(auth.username, auth.password)
if result == 0:
return redirect('/')
elif result == 1:
response = jsonify()
session["user"] = auth.username
response.headers['location'] = "/dashboard"
response.autocorrect_location_header = False
return response
else:
return redirect('/')
else:
return "Unauthorized"
@app.route("/dashboard", methods=['GET'])
def dashboard():
if(check_logged_in()):
return render_template('dashboard.html')
else:
return redirect('/')
Finally when a user attempts to visit a section of the site, I first check if they have a valid session
def check_logged_in():
return "user" in session
Does this seem right or am I missing something?