vbatts/quay
Archived
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Move each flask module into a Blueprint and have CSRF protection only on the API blueprint

Browse source
This commit is contained in:
Joseph Schorr 2013-12-30 17:05:27 -05:00
parent b598c7ec85
commit 310c98df50
8 changed files with 174 additions and 162 deletions
Download patch file Download diff file Expand all files Collapse all files

15
endpoints/common.py
View file

@ -51,15 +51,14 @@ def common_login(db_user):
return False
@app.before_request
def csrf_protect():
if request.method != "GET" and request.method != "HEAD":
token = session.get('_csrf_token', None)
found_token = request.values.get('_csrf_token', None)
@app.errorhandler(model.DataModelException)
def handle_dme(ex):
return make_response(ex.message, 400)
# TODO: add if not token here, once we are sure all sessions have a token.
if token != found_token:
abort(403)
@app.errorhandler(KeyError)
def handle_dme_key_error(ex):
return make_response(ex.message, 400)
def generate_csrf_token():