How can I create a custom login validation method for flask-httpauth?

Question

Today I am creating a small RESTfull service with python and flask. I cannot seem to work out the auth, it seems.

Here is my code :

# Extensions
auth = HTTPBasicAuth()

def login_user(username,password):
    # If the username can be decoded as a JWT & the password is empty, return true
    if jwt.decode(username, SERVER_PAYLOARD_SECRET, algorithms=['HS256']) == '{"some":"payload"}' and password == "":
        return username and password
    else:
        # Otherwise, make the classic username/password verification
        # Get the password corresponding to the username.
        connection = sqlite3.connect(database_name)
        cursor = connection.cursor()
        cursor.execute("SELECT Username AND Password FROM Users WHERE Username = ?", (username))
        returned_data = cursor.fetchall()
        # Do the verification
        if returned_data[0] == username and pwd_context.verify(password,returned_data[1]):
            return username and password
        else:
            abort(401)

@auth.get_password
def verify_password(username,password):
    return login_user(username,password)
    # Look if the token used is in memory

@app.route('/api/user/delete_user', methods=['GET','POST'])
@auth.login_required
def delete_user():
    # Validate the login token, and then delete the user from the
    # database and all the streams or information he has.
    return "Hello World"

I don't know what I could return, and if my login_user() function is correct.

Thanks for your help,

Cheers

Edit : When I run the code, I have this error :

    Traceback (most recent call last):
  [...]
  File "/home/n07070/FarDrive/Code/OpenPhotoStream/lib/python3.4/site-packages/flask_httpauth.py", line 57, in decorated
    password = self.get_password_callback(auth.username)
TypeError: verify_password() missing 1 required positional argument: 'password'

Answer 1

Small mistake. Change this:

@auth.get_password
def verify_password(username,password):
    return login_user(username,password)
    # Look if the token used is in memory

to this:

@auth.verify_password
def verify_password(username,password):
    return login_user(username,password)
    # Look if the token used is in memory

Flask-HTTPAuth provides a few different ways in which you can verify the client's credentials. The @auth.get_password is a very simple one, your decorated function takes the username and you need to return the password that corresponds to that account. The @auth.verify_password is a more flexible option, which gives you the credentials provided by the client, and you can implement your own verification logic. Sounds like this last option is what you want.