Restrict static file access to logged in users

by

Flask adds a static route to serve static files. When you’re in production, you typically “short circuit” this route so that Nginx serves the files before the request ever gets to your app. Instead of adding this “short circuit”, leave it out and let Flask handle the requests. Overwrite the static route with one that is wrapped by Flask-Login’s login_required.

from flask_login import login_required

app.view_functions['static'] = login_required(app.send_static_file)

This is typically overkill though, since you want truly static files to be served no matter what so that pages look right to non-logged in users (otherwise the CSS wouldn’t even be sent for the login page). Instead, “short circuit” the static folder to be served by Nginx, and define a route that will serve protected files from some other directory, such as the instance folder. See flask.send_from_directory.

import os
from flask import send_from_directory
from flask_login import login_required

@app.route('/protected/<path:filename>')
@login_required
def protected(filename):
    return send_from_directory(
        os.path.join(app.instance_path, 'protected'),
        filename
    )

This will serve files from the directory “protected” in the instance folder to logged in users only. Other restrictions could also be added, such as only allowing certain users access to certain files. Similar to the static path, you can generate a url to a file with:

url_for('protected', filename="data/example.csv")

More Related Contents:

  1. Are a WSGI server and HTTP server required to serve a Flask app?
  2. Flask application traceback doesn’t show up in server log
  3. Flask Gunicorn app can’t get __name__ to equal ‘__main__’
  4. X-Forwarded-Proto and Flask
  5. How do I run a long-running job in the background in Python
  6. How to serve static files in Flask
  7. Sending data from HTML form to a Python script in Flask
  8. Link to Flask static files with url_for
  9. Store large data or a service connection per Flask session
  10. jsonify a SQLAlchemy result set in Flask [duplicate]
  11. How do I get the different parts of a Flask request’s url?
  12. Flask to return image stored in database
  13. Why use Flask’s url_for?
  14. Remove file after Flask serves it
  15. Making an asynchronous task in Flask
  16. Send data from a textbox into Flask?
  17. Serve image stored in SQLAlchemy LargeBinary column
  18. Preserving global state in a flask application [duplicate]
  19. Flask view shows 400 error instead of template with form
  20. Create dynamic arguments for url_for in Flask
  21. Get root path of Flask application
  22. Flask url_for generating http URL instead of https
  23. IOError: [Errno 13] Permission denied: ‘geckodriver.log when running Python/Selenium
  24. Querying with function on Flask-SQLAlchemy model gives BaseQuery object is not callable error
  25. Flask broken pipe with requests
  26. Getting value from select tag using flask
  27. Decoding base64 from POST to use in PIL
  28. ImportError: cannot import name ‘Markup’ from ‘jinja2’
  29. Handling large file uploads with Flask
  30. gcloud app deploy : This deployment has too many files

Leave a Comment