Authentication answers “Who are you?” Authorization decides “What can you do?” It uses a user’s role or permissions to control access to actions, resources, and application routes. section 9.6 section 9.9
A role-based authorization design can assign capabilities such as:
- Administrators can update, activate, or deactivate any content and can activate or deactivate users. section 9.6
- Editors can update any content but cannot deactivate users or content. section 9.6
- Registered users can create, activate, or deactivate their own content without changing another user’s content or active state. section 9.6
Protecting an administrator route
Stack route decorators so a user must be logged in and possess the administrator permission. The authorization check aborts with HTTP 403 Forbidden when the permission is missing; otherwise, the route continues normally. section 9.6.2
from functools import wraps
from flask import abort
from flask_login import current_user
def authorization_required(permissions): #1
def wrapper(func): #2
@wraps(func) #3
def wrapped_function(*args, **kwargs): #4
if not current_user.role.permissions
& permissions: #5
abort(403) #6
return func(*args, **kwargs) #6
return wrapped_function
return wrapper
The decorator accepts a permission, compares it with the current user’s permissions using a bitwise check, aborts unauthorized requests, and invokes the protected function when allowed. section 9.6.2
