Accepting POST data instead of GET in examples/flask-api

[aferust]

I am trying to settle a server for a react-native app based on examples/flask-api. it seems that server.py accepts requests as GET data. I want to learn two things. Is using GET safe enough? Can I use POST requests for more security?

[xiongzhp]

I've got the same questions

[aferust]

Hi xiongzhp. I did not want to use form data, but This is what I have done so far:

react-native part:

        var data_ = new FormData();
        data_.append('json', JSON.stringify({
                'Authorization': 'Bearer ' + idToken,
                'req_type': 'updateRecord',
                'mjson': btext,  
                'OS': Platform.OS  // optional
            }));
        fetch(API_ENDPOINT, {
            method: "POST",
            body: data_
            })
            .then((response) => response.json())
            .then((mjson) => {this._success(mjson, obj)})
            .catch((error) => {this._unsuccess(error)});

flask server part in server.py:

# some code here
r_json = {}
r_type = ''

def requires_auth(f):
  @wraps(f)
  def decorated(*args, **kwargs):
    global r_json
    r_json = json.loads(request.form['json'])
    global r_type
    r_type = r_json['req_type']
# some code here

@app.route("/secured/ping", methods=['POST'])
#@cross_origin(headers=['Content-Type', 'Authorization'])
@cross_origin(headers=['Content-Type', 'application/json'])
@cross_origin(headers=['Access-Control-Allow-Origin', '*'])
@requires_auth
def securedPing():
    return makeResponse()

def makeResponse():
    if r_type == 'updateRecord':
        json_data = r_json['mjson']

        mstr = base64.b64decode(json_data).decode('string_escape')
        fields = json.loads(mstr)
# some code here

[Annyv2]

Hi! We have moved our API sample to https://github.com/auth0-samples/auth0-python-api-samples