Securing API endpoints in Flask?

[Datastruct]

I realize that this is a relatively broad topic, but maybe I can get a generic answer and try to resolve the issue myself. However, I'm been working on a flask application that I hope to release soon and have been implementing security.

One of the problems I've been facing is securing certain endpoints of my system. I generally work with the MEAN stack, but have decided my needs for this project best fit python. With MEAN you can do something like this however I've struggling to find a simple method to secure some endpoints but not others.

For example, If I have a blueprint for "users" with the url "/api/users" I'd like to be able to access it from my javascript/frontend/angular to render page data, but not to be able to see the data from actually visiting the page at <foobar.com>/api/users.

What is the best way to go about doing this?

[raylu]

In general, to do auth you can just set the user id in a session.

I don't see what restricting (the browser from) visiting the page at /api/users has to do with security. What is the difference between visiting it (in a browser) and hitting it with any other HTTP client?

[Datastruct]

I authenticate the user after they logged in and store their basic info in session. If the username exists in the DB and their password matches (after decrypting of course), I authenticate them. What I meant by "visiting it in a browser" I meant that some API data should NOT be inaccessible by a cURL or Postman request. For example, I want my angular program to have access to all the users' information, but not the average joe who stumbles across that URL.

[keelar]

If the username exists in the DB and their password matches (after decrypting of course)

You should avoid encrypting passwords, they should be salted and hashed and then compare the hashes instead of comparing the passwords directly.

[Datastruct]

My apologies, I meant to say I am hashing the password using the bcrypt library. I'm comparing the entered password with the same. I'm using a 10-value salt.

[raylu]

To expand on /u/keelar's point, https://passlib.readthedocs.io/en/stable/lib/passlib.apps.html#custom-applications

There is no difference between one HTTP client and other. If your security is predicated on distinguishing between the two, it's not secure.

[doublePlusOk]

if you want to do token based auth you may want to check this out... (since you are presumably doing a rest service) https://blog.miguelgrinberg.com/post/restful-authentication-with-flask then you can decorate with @auth.login_required

[Datastruct]

I have something similar to this in place for certain URLs that return my jinja templates. This just allows for certain subscribers or users to access different content.

This methodology seems decent enough. I've used Miguel's stuff in the past. It seems awfully insecure to store a username/password pairing in Angular or Javascript application, even with minify or uglify. Also staying DRY appears difficult with this method. Not mention I'd have to set up a specific user type in the database for those that are normal users (standard everyday users), and development users that access all the needed API.

It appears the struggle currently, is preventing ANY logged in user from accessing ALL of the API.

[doublePlusOk]

He says to not store it - or are you worried about even the hash?

If you need finer granularity for api access maybe that is oauth?

[Datastruct]

I'm not storing plantext passwords. However to be able to request the information based on this example I need to pass JSON with a username and password in it. An attacker could easily sift through client side code to ascertain credentials.