Securing the metrics about flask-profiler HOT 4 CLOSED

At this moment there is not any securing feature. However, I am going to make a basicauth implementation for securing flask-profiler's API and interface. There will be a setting parameter to enable or disable the basic authentication. I think I can complete it within two weeks, because I have a very tight schedule these days. Of course, pull requests will be welcomed :)

from flask-profiler.

I can work on it if you can tell me the complete flow that you have in mind.
Also, it is needed to put in custom decorators for routes or some other mechanism for eg if I am to use flask-limiter, I am not able to limit exempt these admin/flask-profiler routes.

from flask-profiler.

I propose the following flow:

• there must be a setting parameter to enable or disable security feature.

app.config["flask_profiler"] = {
    "enabled": app.config["DEBUG"],
    "storage": {
        "engine": "sqlite"
    },
    "basicAuth": {
        "enabled": True,
        "user": "mustafa",
        "password": "mypassword"
    }
}

• If the basicAuth.enabled is False, flask-profiler's routers should be accessible by everyone. No authentication will be asked.
• if the basicAuth.enabled is True, then flask-profiler's routers must be secured and should serve only to authenticated users.

To protect routers, a decorator which implements basicauth could be used. This is a straightforward approach but sufficient for our purpose. For example; every router definition of flask-profiler's will be decorated by @requires_auth as follows:

   @fp.route("/api/measurements/".format(urlPath))
   @requires_auth
    def filtermeasurements():
        args = dict(request.args.items())
        measurements = collection.filter(args)
        return jsonify({"measurements": list(measurements)})

reference for implementation of basicAuth: http://flask.pocoo.org/snippets/8/

This decorator has to ask authentication if basicauth.enabled is True.

Any comment?

from flask-profiler.

That would do the back-end but I think there will be more to security. At front-end, it would need a login screen and then js service accordingly to save and plug in the auth values into each subsequent request.
That would do it.

from flask-profiler.