Authenticating Flask API with Wordpress - wordpress

Question

I have two websites, a Wordpress blog that hosts the majority of the content. I also have written an API with Flask. I would like to consume the API within Wordpress (a password-protected page), but I need to verify that the request is authenticated before responding from Flask.
How can I verify that there is a user logged in from Wordpress when I get a request to the Flask API?

Answer 1

You can implement an API Key Authentication (example in Flask: https://blog.teclado.com/api-key-authentication-with-flask/) or simply just use JWT.
For extra security, we can limit to accept request from certain domains like your Wordpress page, add expiration or allow to revoke a key.

Answer 2

I'm not clear whether you are communicating directly between WordPress and the Flask app (i.e. a server-to-server API) or whether you want the browser that is showing a WordPress page to then call an API hosted in the Flask app. If the former, then the API key method described by hungtran273 could work well for you.
This answer focuses on the latter (JS in the browser that proves the WordPress identity to the Flask app). This plugin uses a private key to produce a JWT for the user login. This avoids adding an API key per-user The Flask app can then use the associated public key to verify the JWT.
As written, this requires you put the private key in PEM format in the same directory as the plugin, which is not a good practice in production use.
rk_certinfo.php
<?php
/**
* Plugin Name: CertifiedUserInfo
* Plugin URI: https://ricardkelly.com/
* Description: Provides a JWT asserting the logged-in user to the site
* Version: 1.0.0
* Requires at least: 5.2
* Requires PHP: 7.2
* Author: Ricard Kelly
* Author URI: https://ricardkelly.com/
*/
function rk_certinfo_infoblock() {
if ( is_user_logged_in() ) {
$current_user = wp_get_current_user();
$subject = $current_user->user_login;
$header = json_encode([
'typ' => 'JWT',
'alg' => 'RS256',
]);
$payload = json_encode([
'iss' => get_site_url(),
'sub' => $subject,
'iat' => time(),
'exp' => time() + (60*60*24),
]);
$base64UrlHeader = str_replace(['+', '/', '='], ['-', '_', ''], base64_encode($header));
$base64UrlPayload = str_replace(['+', '/', '='], ['-', '_', ''], base64_encode($payload));
$data = $base64UrlHeader . "." . $base64UrlPayload;
$keyPrivatePath = plugin_dir_path( __FILE__ ) . 'private-key.pem';
$fp = fopen($keyPrivatePath,"r");
$privateKey = fread($fp,8192);
fclose($fp);
openssl_sign($data, $signature, $privateKey, OPENSSL_ALGO_SHA256);
$base64UrlSignature = str_replace(['+', '/', '='], ['-', '_', ''], base64_encode($signature));
$jwt = $data . "." . $base64UrlSignature;
echo "<script>\nfunction rk_certinfo() {\n";
echo " return \"" . $jwt . "\";\n";
echo "}\n";
echo "</script><!-- \n";
echo $payload;
echo "\n -->\n";
}
}
add_action( 'wp_footer', 'rk_certinfo_infoblock' );
?>
The code emits a script function that you can call from elsewhere in your page to get the JWT for passing to the Flask API. It also emits a comment that just gives you the signed info, which you would probably remove from the plugin after verifying it is producing the information you expect.
Here's a Flask app that consumes the JWT token in the Authorization header.
app.py
from flask import Flask, jsonify, request
from functools import wraps
import jwt
app = Flask(__name__)
public_key = """-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKY5qH99Ouc/M/egCu6Z
ignTibNPXjNMOK2JYF00ytkfvafqMLuKrEjfExs6U+VQxqQQ4ZyzG/owaqht/zlR
aNhJMJOf0GA5EjtrT++uLh5k5MkA+hgWkRqIB869vctEpUSWzSOwOAR1OFoRXDAR
eESAw+LM4U/o9jq7A9IkgrgpoTC2F5th3ps4Sm7d2xiCLxyRWBmHHTYm7xaybOMe
xA7RzJCT04eUWwobYXdpvfhL8+izOuQlaA1+/dMCnaUWLModULgDlQFYDItULLNk
CF9UkrfpwYJUsO6oP/Ue7GvqtRHYkOfTh5GKtmB+pSlCuc+k+IPbeq6ljHFOLFTl
kQIDAQAB
-----END PUBLIC KEY-----
"""
def token_required(f):
#wraps(f)
def decorator(*args, **kwargs):
token = None
if 'Authorization' in request.headers:
token = request.headers['Authorization']
token = token.replace('Bearer','').strip()
if not token:
return jsonify({'message': 'a valid token is missing'})
try:
data = jwt.decode(token, public_key, algorithms=["RS256"])
current_user = data['sub']
except Exception as ex:
return jsonify({'message': 'token is invalid'})
return f(current_user, *args, **kwargs)
return decorator
#app.route('/api/<id_value>')
#token_required
def api_call(current_user, id_value):
return jsonify({'message': f'id provided was {id_value} by {current_user}'})
if __name__ == '__main__':
app.run(host='0.0.0.0', port='5000')