Skip to content

Conversation

@RenaudLN
Copy link
Contributor

Currently only the index page (/) prompts users to login, whereas other pages return a 403 error.

It would be a lot nicer to be able to share a page (especially with multi-pages) and that it just prompts the user to authenticate then an there rather than having to go through the index.

@alexcjohnson
Copy link
Collaborator

Thanks @RenaudLN! This seems like it would work, though it begs the question of why we had separate handling of index and other endpoints in the first place, is there really no reason to return a bare 403 on these other routes instead of always prompting for login on any request?

Another option - if we do want to keep the 403 on non-page requests - would be to catch both index routes: the one we catch now:

self._index_view_name = app.config['routes_pathname_prefix']

as well as app.config['routes_pathname_prefix'] + '<path:path>' that handles all other pages.

@RenaudLN
Copy link
Contributor Author

RenaudLN commented Jul 6, 2023

Hey @alexcjohnson I actually created another PR that feels like a cleaner implementation, using flask's before_request decorator. With the current state only the routes that are created before the Auth is instantiated is protected which can easily lead to security issues if devs aren't careful.

@RenaudLN RenaudLN closed this Aug 11, 2023
@RenaudLN
Copy link
Contributor Author

Replaced by #141

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants