python - 使用curl发送请求时Flask可以处理 session 吗？

Question

这个问题已经有答案了:

How to use cURL to send Cookies? (10 个回答)

已关闭 6 年前。

我正在尝试为我的 iOS 移动应用构建一组 API。

我使用Flask-RESTful' to build RESTful type of interfaces and Flask-login` 帮助我处理用户登录问题。

但是，我发现，当我使用curl时登录时，服务器确实返回成功消息，然后我发送请求以获取“ protected ”页面，只有登录的用户才能看到和获取

{ "message": "The server could not verify that you are authorized to access the URL requested. You either supplied the wrong credentials (e.g. a bad password), or your browser doesn't understand how to supply the credentials required." }

如果curl不发送一些“用户凭据”，这是否意味着当我的 iOS 应用程序发送请求时，后端仍然无法识别用户？

我不太明白 Flask 如何处理“ session ”，而且我是 Web 开发的新手。有什么解决办法吗？

这是我的代码:

api.py

# -*- coding: utf-8 -*-

import flask_login, json
from flask import request
from flask_restful import Resource, reqparse
from models import users, User

parser = reqparse.RequestParser()


def request_parser():
    parser.add_argument('data', action='append')
    return parser.parse_args()['data'][0]


class Login(Resource):
    def get(self):
        return

    def post(self):
        # data = request_parser()
        data = request.json['data']
        email = data['email']
        test = users[email]
        if data['pw'] == users[email]['pw']:
            user = User()
            user.id = email
            flask_login.login_user(user)
            return 'login success'

        return 'Bad login'



class Protected(Resource):
    @flask_login.login_required
    def get(self):
        return 'Logged in as: ' + flask_login.current_user.id

models.py

# -*- coding: utf-8 -*-
import flask_login
from app import login_manager


users = {'foo@bar.tld': {'pw': 'secret'}}


class User(flask_login.UserMixin):
    pass


@login_manager.user_loader
def user_loader(email):
    if email not in users:
        return

    user = User()
    user.id = email
    return user


@login_manager.request_loader
def request_loader(request):
    email = request.form.get('email')
    if email not in users:
        return

    user = User()
    user.id = email

    user.is_authenticated = request.form['pw'] == users[email]['pw']

    return user

__init__.py

# -*- coding: utf-8 -*-

from flask import Flask
from flask_restful import Resource, Api
from flask_sqlalchemy import SQLAlchemy

import flask_login
import config

app = Flask(__name__)
app.config.from_object("config")
app.secret_key = 'yangjinglei'

api = Api(app)

login_manager = flask_login.LoginManager()
login_manager.init_app(app)

db = SQLAlchemy(app, use_native_unicode="utf8")

run.py

# -*- coding: utf-8 -*-

from app import app, api
from app.api import *


api.add_resource(Login, '/login')
api.add_resource(Protected, '/protected')

if __name__ == '__main__':
    app.run(debug=True)

Answer 1

默认情况下，Flask 使用 cookie 管理 session 。引用Sessions documentation :

This is implemented on top of cookies for you and signs the cookies cryptographically. What this means is that the user could look at the contents of your cookie but not modify it, unless they know the secret key used for signing.

您可以从curl cli 管理cookie。引用this answer

要写入 cookie 文件并启动引擎并使用 cookie，您可以使用:curl -c/path/to/cookiefile http://yourhost/

从中读取cookie并启动cookie引擎，或者如果它不是文件，它将传递给定的字符串。curl -b/path/to/cookiefile http//yourhost/

可以遵循的另一个模式是 server side sessions .