2
\$\begingroup\$

I wrote a small webserver using flask and python to test the response of a program. When the user try to login the program sends to the server a xml file with the data and if everything works, returns a xml file and a cookie if something goes wrong it returns a xml file with the error.

I am new on all this and would like to get some opinion on what I did and maybe how I could improve.

import uuid
import hashlib
from flask import Flask, request, make_response, redirect
import xmltodict
from xml.etree import ElementTree as xml


Server = Flask(__name__)

_email = '[email protected]' #email to be sent via xml to test
_password = 'keineahnung'  #password to be sent via xml to test



#if one of the values above does not match the values sent through the xml 
#file
#the method LoginError will be called and the xml file loginError will be 
#sent as response

@Server.route('/', methods=['GET']) 
# This is a test I wanted to implement to check via browser if I can 
#redirect the user to the login page

def api_root():   

    for name in request.cookies: 

    #search if the cookie with the user email already exists

    value = request.cookies.get('sessionid')
    if  value ==  hashlib.md5(_email.encode('utf')).hexdigest():
        print('Logged')

        return 'Welcome back, '+_email

return redirect('/login', code=302)

@Server.route('/login', methods = ['GET','POST'])
def Login(): 

if request.method == 'GET': 
#Test the cookie session via browser
    return LoginPassed(_email) 
#Pass automatically the right email so the cookie can be created
else:

    xmlFile = xmltodict.parse(request.data) #Converts the xml to json dict
    user = xmlFile['LOGIN']['BENUTZER']
    password = xmlFile['LOGIN']['PASSWORT']

for name in request.cookies: 
#search if the cookie with the user email already exists

    value = request.cookies.get('sessionid')
    if  value ==  hashlib.md5(user.encode('utf')).hexdigest():
        print('Logged')
        redirect('/loginPassed.xml', code=302)
        return 'Welcome back, '+user
    return LoginError()

#if a post request is made the login file is decoded into a json dictionary
#the user email and password sent through the file are checked against the 
_email and _password constant values

if request.method == 'POST':   
    if user == _email: 
        if password == _password: 
            return LoginPassed(user)     
    return LoginError()


#if email or password does not match this function will be called
# a loginError.xml will be returned

@Server.route('/loginError.xml', methods=['GET', 'POST'])
def LoginError():  
    print('Login Failed')  
    redirect('/loginError.xml', code=302)
    response = make_response(open('LoginError.xml').read())
    response.headers["Content-type"] = "text/xml"
    return response

#If login data is correct the app.route delivers the loginPassed.xml file
# and creates a new session_id and cookie for the user

@Server.route('/loginPassed.xml', methods=['GET', 'POST'])
def LoginPassed(user):
    print('Loged w success')
    _cookieExpireOn = 60 #cookie expires in 60 seconds
    sessionid = hashlib.md5(user.encode('utf')).hexdigest() 
    #generates the session id for the cookie   
    response = make_response(open('LoginPassed.xml').read())

    response.headers["SESSION"] = sessionid 
    #includes the session on the header
    response.set_cookie('sessionid', sessionid, path= '/login', 
    max_age=_cookieExpireOn, secure=False, httponly=True) 
    #creates the session cookie using email
    return response    

#initializes the app
if __name__ == '__main__':

Server.run(host='0.0.0.0', port=80)

This doesn't need to work via webbrowser

P.S:Thanks for the critics and suggestions to improve. I am trying to learn software development and it is really important for me all that help with get here from all of you.

\$\endgroup\$
0

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.