quart-auth 0.2.0

Usage

To use Quart-Auth with a Quart app you have to create an AuthManager and initialise it with the application,

app = Quart(__name__)
AuthManager(app)

or via the factory pattern,

auth_manager = AuthManager()

def create_app():
    app = Quart(__name__)
    auth_manager.init_app(app)
    return app

In addition you will need to configure Quart-Auth, which defaults to the most secure. At a minimum you will need to set secret key,

app.secret_key = "secret key"  # Do not use this key

which you can generate via,

>>> import secrets
>>> secrets.token_urlsafe(16)

Tou may also need to disable secure cookies to use in development, see configuration below.

With AuthManager initialised you can use the login_required function to decorate routes that should only be accessed by authenticated users,

from quart_auth import login_required

@app.route("/")
@login_required
async def restricted_route():
    ...

You can also use the login_user, and logout_user functions to start and end sessions for a specific AuthenticatedUser instance,

from quart_auth import AuthUser, login_user, logout_user

@app.route("/login")
async def login():
    # Check Credentials here, e.g. username & password.
    ...
    # We'll assume the user has an identifying ID equal to 2
    login_user(AuthUser(2))
    ...

@app.route("/logout")
async def logout():
    logout_user()
    ...

Extending Quart-Auth

Quart-Auth is meant to be extended, much like Quart (and Flask), a good example of this is loading user data from a database,

from quart import Quart
from quart_auth import AuthUser, AuthManager, current_user, login_required

class User(AuthUser):
    def __init__(self, auth_id):
        super().__init__(auth_id)
        self._resolved = False
        self._email = None

    async def _resolve(self):
        if not self._resolved:
            self._email = await db.fetch_email(self.auth_id)
            self._resolved = True

    @property
    async def email(self):
        await self._resolve()
        return self._email

auth_manager = AuthManager()
auth_manager.user_class = User

app = Quart(__name__)

@app.route("/")
@login_required
async def index():
    return await current_user.email

auth_manager.init_app(app)

Configuration

The following configuration options are used by Quart-Auth,

The COOKIE related options refer directly to standard cookie options. In development it is likely that you’ll need to set QUART_AUTH_COOKIE_SECURE to False.

Contributing

Quart-Auth is developed on GitLab. You are very welcome to open issues or propose merge requests.

$ pip install tox
$ tox

Help

This README is the best place to start, after that try opening an issue.