PYTHON

How to secure an endpoint for selected users with Flask-JWT-Extended

from flask import abort
from flask_jwt_extended import current_user

@app.route('/users/<userid:int>/edit')
@jwt_required
def users_edit(userid):
    if userid != current_user.id:
        abort(403)

    # ... handle view for matching user

How to secure an endpoint for selected users with Flask-JWT-Extended

# assuming that the sub claim is an integer value
    if userid != get_jwt_identity()

How to secure an endpoint for selected users with Flask-JWT-Extended

from functools import wraps
from flask_jwt_extended import current_user, jwt_protected

def userid_must_match(f):
    """Abort with a 403 Forbidden if the userid doesn't match the jwt token

    This decorator adds the @protected decorator

    Checks for a `userid` parameter to the function and aborts with 
    status code 403 if this doesn't match the user identified by the
    token.
    
    """

    @wraps(f)
    @jwt_protected
    def wrapper(*args, userid=None, **kwargs):
        if userid is not None and userid != current_user.id:
            abort(403)
        return f(*args, **kwargs)

    return wrapper

How to secure an endpoint for selected users with Flask-JWT-Extended

@app.route('/users/<userid:int>/edit')
@userid_must_match
def users_edit():
    # ... handle view for matching user

How to secure an endpoint for selected users with Flask-JWT-Extended

from flask import abort
from flask_jwt_extended import current_user

@app.route('/users/edit')
@app.route('/users/<userid:int>/edit')
@userid_must_match
def users_edit():
    # ... handle view for matching user via current_user