Adding HTTP Basic Auth to all calls

[sylvinus]

If I want to expose Flower on the web and don't want to use OAuth to log in, I think there's currently no solution.

Here is a rough patch I made to urls.py to add HTTP Basic Auth on all requests. It sure needs more work to connect it to the config system for instance but I guess you could use it as a base for adding support:

35a36,37
> import functools
> import base64
37c39
< handlers = [

---
> _handlers = [
84a87,147
> 
> """
>     This patch adds mandatory HTTP Basic Auth to all requests, except websockets
> """
> 
> # http://kelleyk.com/post/7362319243/easy-basic-http-authentication-with-tornado
> def require_basic_auth(handler_class, auth):
> 
>     def _request_auth(handler):
>         if hasattr(handler, "ws_connection"):
>             return True  # TODO, basic auth not supported in websockets
> 
>         handler.set_header('WWW-Authenticate', 'Basic realm=Flower')
>         handler.set_status(401)
>         handler._transforms = []
>         handler.finish()
>         return False
> 
>     def wrap_execute(handler_execute):
>         def require_basic_auth(handler):
>             auth_header = handler.request.headers.get('Authorization')
>             if auth_header is None or not auth_header.startswith('Basic '):
>                 return _request_auth(handler)
> 
>             auth_decoded = base64.decodestring(auth_header[6:])
> 
>             username, password = auth_decoded.split(':', 2)
> 
>             if (auth(username, password)):
>                 return True
>             else:
>                 return _request_auth(handler)
>             
>         def _execute(self, transforms, *args, **kwargs):
>             if not require_basic_auth(self):
>                 return False
>             return handler_execute(self, transforms, *args, **kwargs)
>         return _execute
> 
>     handler_class._execute = wrap_execute(handler_class._execute)
>     return handler_class
> 
> 
> def oxauth(username, password):
>     return "%s:%s" % (username, password) == config.config["FLOWER_AUTH"]
> 
> 
> # Force-add httpauth to each handler
> handlers = []
> for h in _handlers:
>     if len(h) > 2:
>         handlers.append((h[0], require_basic_auth(h[1], oxauth), h[2]))
>     else:
>         handlers.append((h[0], require_basic_auth(h[1], oxauth)))

[sylvinus]

By the way, HTTP Auth support has been added to the -13 draft for WebSockets, but still not supported by most browsers (http://code.google.com/p/chromium/issues/detail?id=47069) or Tornado AFAIK

[mher]

HTTP Basic Auth support is ready. Please try the master.

[NotSqrt]

For angry people like me, in addition to the comment of sylvinus, it works with Firefox (24.0 on my computer), but not with chromium or chrome (30.0).. but it's not something that Flower can circumvent..