Eve: Building RESTful APIs with MongoDB and Flask Transcripts
Chapter: Fine-tuning your REST service
Lecture: Securing the service

Learn more about this course
Login or purchase this course to watch this video and the rest of the course contents.
0:00 Authentication is the mechanism
0:02 by which systems securely identify their users.
0:06 Eve supports several authentication schemes,
0:10 like basic authentication, token authentication, and also HMAC authentication.
0:15 Authorization on the other hand is the mechanism
0:18 by which a system determines what level of access
0:21 a particular authenticated user should have
0:24 to access resources controlled by the system.
0:27 In Eve, you can restrict access to all API endpoints or just a few of them,
0:31 you can protect some http verbs while leaving others open.
0:36 You really have a lot of options.
0:39 Security is one of those areas where customization is really important,
0:44 this is why you are provided with a handful of base authentication classes
0:49 from which you inherit in order to build your own authorization logic.
0:54 Let's see how it's done.
0:57 Yes, in order to get authentication going on our service,
1:01 we need to get back to coding, which is probably good news
1:05 after all this time spent on a boring settings file.
1:08 First, we need to import from the eve.auth name space
1:15 and what we want to import is the BasicAuth class.
1:19 Once we have the class imported, we need to inherit from it.
1:28 Here it is, as you can see, I created my own class
1:33 which is a subclass of the BasicAuth, class provided by the framework.
1:38 And the only method I need to overwrite is check auth,
1:42 it gets a number of arguments, the most interesting ones
1:47 are the first two, username and password,
1:50 then we have a few more, allowed roles,
1:53 which is used when you do role based access control
1:57 something we won't cover in this course,
1:59 resource is the name of the resource
2:02 or endpoint that the client is hitting
2:04 and the method is the http method being performed with the request.
2:10 So, every time a request comes to the server,
2:14 the check auth method is executed, and within the method,
2:20 we implement the custom logic we need to authenticate the user.
2:24 now in this example, it is super simple, we are just making sure
2:27 that the username is admin and the password is secret.
2:30 Now that the authentication logic has been implemented,
2:35 all we need to do is pass our class to the Eve instance
2:40 and we do that right here where we are passing the custom validator
2:44 we can also set the auth argument which defaults to none,
2:49 so no authentication, to our custom authentication class.
2:54 We save, go back to Postman and try to access the people endpoint
3:01 which has been freely available, until now,
3:06 but now we're getting a 401 error, not authorized please provide proper credentials.
3:14 Now, if you go to the auth tab here in Postman,
3:17 we can pick basic authentication and pass our username,
3:23 let's try with secret and password which should not be right,
3:29 because we are testing for admin and secret as password.
3:33 We can preview the request, if we go back to the headers,
3:37 we see that authorization header has been added to our request
3:41 and it has our username and password encoded,
3:45 let's try and send the request over, we're still getting an error.
3:50 That's right because we got the password wrong,
3:54 let's try with secret and send a request over, and this time it works.
4:01 So now all the endpoints are protected by our custom class and custom logic,
4:10 let's try works, of course, we get an access,
4:15 but if we go with no auth, again, we get an error
4:21 whereas if we go back to basic authentication, it works.
4:27 Okay, let's go back to the editor and review what we've done so far.
4:32 We imported the basic authentication class from the framework,
4:36 then, we inherited from it in our own custom class
4:40 and we overwrote the check auth method
4:44 it is receiving a number of arguments,
4:46 and we use the username and password from the request
4:48 to make sure that they match our expectations.
4:51 If they do, we return a true value, otherwise, we return a false value or nothing.
4:57 That's it, we then pass our class to the Eve instance.
5:01 Now our authentication logic is very simple,
5:06 we are protecting all the endpoints with the same logic,
5:09 but because we are receiving resource,
5:11 which is the endpoint and the method,
5:14 we can actually be more fine grained if we need,
5:18 for example, we might have a different logic if the endpoint is people
5:24 we might do some kind of check
5:28 whereas for any other endpoint we use the general logic,
5:36 the same might be true with the method,
5:53 so if it is a write operation, post or edit, we do some kind of different check,
5:58 maybe only some super user is allowed to write,
6:03 let me also add put and delete, you get the point.
6:13 Now branching on every endpoint can get ugly really fast,
6:19 imagine if you have 100 endpoints on your API
6:22 and you actually want to implement
6:25 a different authentication schema for every endpoint,
6:28 it is not going to look pretty, and also not easy to maintain.
6:31 There should be better ways to handle authentication.
6:35 And in fact, there are.
6:37 Let's see at one of them, let's go back to our basic logic here,
6:44 what we can do is go to our settings file
6:49 and import basic authentication class,
6:59 and then, within the endpoint definition,
7:06 we can set the authentication class to be used for the single endpoint.
7:11 So if we do this, only the people endpoint will use this class,
7:16 let's go back to the app and get read of the global authentication class.
7:23 So what we are doing here is tell Eve,
7:27 look we have no authentication for the endpoints
7:31 no global authentication for the endpoints,
7:34 but, we do have authentication schema and class to be used
7:39 whenever a client requests an access to the people endpoint,
7:44 let me go and illustrate that with an example,
7:49 now that the server has restarted,
7:51 if we try to hit the people endpoint with a get request
7:54 we should get please provide proper credential message,
7:59 that's right, let me fix the username and try again.
8:04 Boom, it works.
8:06 But, if I go to the works endpoint
8:08 which should have no authentication at all, it works.
8:13 So this way you can write custom classes,
8:17 one class for every endpoint, or of course,
8:21 you might have the same class shared between different endpoints,
8:24 but the point is that you keep your classes super simple,
8:28 you only implement the logic needed by the class,
8:31 this could be called something like people authentication,
8:34 this is much better, isn't it?
8:37 There is a lot more about authentication and authorization in Eve,
8:43 I really invite you to go and visit the
8:47 authentication and authorization documentation on the website
8:51 we only touched the basic features basically,
8:55 just know that you can also implement token based authentication,
8:59 HMAC authentication which is what Amazon is doing with S3 service
9:04 and you also have a role based access control,
9:07 user restricted resource access, auth driven data based access,
9:12 auth 2 integration, go and have a look at it
9:16 so you can better access what you really need for your specific use case.