Hackforge Academy

Explanation

Authentication verifies who the user is, while authorization determines what the authenticated user is allowed to access.

Code:

Login
  |
  v
Authentication
  |
  v
JWT Token
  |
  v
Protected API
  |
  v
Authorization

Explanation

Flask-JWT-Extended can be used to create JWT access tokens after successful authentication.

Code:

from flask_jwt_extended import create_access_token

access_token = create_access_token(
    identity='user101'
)

Explanation

The client sends the JWT in the Authorization header when accessing protected endpoints.

Code:

Authorization: Bearer <JWT_TOKEN>

Explanation

The jwt_required decorator protects a Flask endpoint from unauthenticated access.

Code:

from flask_jwt_extended import jwt_required

@app.get('/profile')
@jwt_required()
def profile():
    return {'message': 'Protected profile'}

Explanation

The current user's identity can be extracted from the validated JWT token.

Code:

from flask_jwt_extended import get_jwt_identity

@jwt_required()
def profile():
    user_id = get_jwt_identity()
    return {'user_id': user_id}