v7.0.0-token-authentication

Protect API endpoints as the web client protects select pages from anonymous access.

• Generate tokens
• Add token expiration to improve security
• Revoke the token if needed instead of relying entirely on the expiration time

Basic authentication requires that a client provide a user's username and password in the request. The user's credentials are base64 encoded and the result is added to the Authorization header sent by the client.

The server will then create a token for the selected user. Now, this user can be verified based on their token. A 401 Unauthorized error response will be generated if there is no such user.

To protect endpoints, add token_auth.login_required. The decorator comes from Flask-HTTPAuth.

With the user authenticated and authorized, each protected endpoint can be accessed by adding the selected user's token in the Authorization header as Authorization: Bearer < token >.