Disable jwt_required for OPTIONS requests

[ludusrusso]

I notice that if a try to protect an entire blueprint with @jwt_required, than also the OPTIONS method is protected.

OPTIONS method should not include crendetials, see here.

The @jwt_required decorator should ignore OPTIONS like in flask_login:

    @wraps(func)
    def decorated_view(*args, **kwargs):
        if request.method in EXEMPT_METHODS:
            return func(*args, **kwargs)
        elif current_app.login_manager._login_disabled:
            return func(*args, **kwargs)
        elif not current_user.is_authenticated:
            return current_app.login_manager.unauthorized()
        return func(*args, **kwargs)
    return decorated_view

where EXEMPT_METHODS=set(["OPTIONS"])!

I could fix this and create a pull request if this is not a desired choice!

[vimalloc]

Possibly related to #116.

I'm not opposed to adding that, but I want to make sure I understand the whole situation first. How is it that you are decorating an entire blueprint? And are you building the OPTIONS endpoint yourself or using something like flask-cors?

Thanks for the report 👍

[ludusrusso]

It was just a trial :D I know it's not a correct way to do it, but essentially I created an admin blueprint that I want to protect entirely and I attached @jwt_required to the before_request...

admin = Blueprint('admin', __name__, url_prefix='/api/admin/1.0')

@admin.before_request
@iwt_required
def check_admin(*args, **kargs):
    pass

After that, playing with Angular5 and Chrome, I've found out that there was an authorization error, and after googling around I've found out that Chrome and other browsers, according to the CORS standard, remove the Authorization header!

I did not implemented the options method on my self!

I'm using flask-cors (but I'm quite sure it is not related with the CORS response) and no, it's not a duplicate of #116 :D

[ludusrusso]

I wrote a super simple code (with tests) to explain the issue.

# example_app.py

from flask import Flask, Blueprint
from flask_jwt_extended import JWTManager, jwt_required, create_access_token
from flask_cors import CORS

app = Flask(__name__)
app.config["SECRET_KEY"] = 'secret'

JWTManager(app)
CORS(app)

protected_bp = Blueprint('protected', __name__)


# This protects the entire blueprint,
# Also the OPTIONS method
@protected_bp.before_request
@jwt_required
def protect():
    pass

@protected_bp.route('/protected', methods=["GET"])
@jwt_required
def protected():
    return 'ok'

app.register_blueprint(protected_bp)

# test.py

import pytest
from example_app import app

def test_access_protected_enpoint():
    client = app.test_client()
    assert client.get('/protected').status_code == 401 # ok

def test_access_protected_enpoint_options():
    client = app.test_client()
    assert client.options('/protected').status_code == 200 # test fails

If you run it, the second test fails, but the standard about CORS says it should not be authenticated.

[vimalloc]

Perfect, thanks for all of the information. It sounds like excluding OPTIONS from the jwt_required functions would be the correct thing to do. If you want to submit a pull request I would be happy to get that merged, or I could work on getting that fixed up sometime next week.

Cheers 👍

[vimalloc]

Released in version 3.7.0.

Thanks for contributing! 👍

[ludusrusso]

Super 👍

[mgd722]

@ludusrusso, above you say you "know it's not a correct way to do it" about protecting a whole blueprint using @protected_bp.before_request and @jwt_required. I never really thought of this as a particularly terrible practice. Is there something I'm missing? Any better alternatives? Just curious. Much thanks for the OPTIONS fix you pushed!

[ludusrusso]

@mgd722 to be honest, I don't remember why I wrote it..
I think I meant that it's not very clean and maybe it should be more pythonic to explicit it by decorating every route that needs to be protected.. What I don't like too much is to have a "do nothing function" and decorate it..

Anyway, I like that practice and I'll continue to use it!!

[ll931217]

@vimalloc Hello, I want to exempt all GET methods, how do I go about doing this?