Question

I’m working on a decorator that validates an api token, my first being to get the decorator in some minimal working order:

def check_token(view_method):
    @wraps(view_method)
    def wrapped_view(*args, **kwargs):
        token = request.args['token']
        if token is None:
            abort(403)
        return view_method(*args, **kwargs)
    return wrapped_view

This sort of works, i.e. the view works if the token is provided, but if not gives a 400 Bad Request error. I want to send a 403 error, but am not aware enough to catch this yet.

What is wrong with this that it only return a 400 error? How do I improve this?

Answer 1

request.args is a MultiDict and it raises if a key is requested which is not there in dict. Here request.args['token'] raises before it reaches to abort(403). Few solutions are:

## If a 2nd optional argument is provided to dict.get then
## it does not raise if key is not found. Instead returns
## the 2nd argument passed as default.

token = request.args.get('token', None)
    if not token:
        ## Error handling

Or:

if 'token' not in request.args or not request.args['token']
    ## Error handling