How to check HTTP basic auth on the python environment of Google Cloud Functions
How could this be implemented?
I'm not sure if it's possible to use the various flask related libraries as they use python decorators - and I don't have access to the Flask routes.
My solution would be to manually get the headers, and parse the authorization string manually. But I'm actually not to sure what format the Authorization follows - is there some library that can handle this complication for me?
flask google-cloud-platform google-cloud-build
asked Nov 16 '18 at 9:10
Chris StryczynskiChris Stryczynski
4,45453378
add a comment |
How could this be implemented?
I'm not sure if it's possible to use the various flask related libraries as they use python decorators - and I don't have access to the Flask routes.
My solution would be to manually get the headers, and parse the authorization string manually. But I'm actually not to sure what format the Authorization follows - is there some library that can handle this complication for me?
flask google-cloud-platform google-cloud-build
asked Nov 16 '18 at 9:10
Chris StryczynskiChris Stryczynski
4,45453378
add a comment |
How could this be implemented?
I'm not sure if it's possible to use the various flask related libraries as they use python decorators - and I don't have access to the Flask routes.
My solution would be to manually get the headers, and parse the authorization string manually. But I'm actually not to sure what format the Authorization follows - is there some library that can handle this complication for me?
flask google-cloud-platform google-cloud-build
asked Nov 16 '18 at 9:10
Chris StryczynskiChris Stryczynski
4,45453378
How could this be implemented?
I'm not sure if it's possible to use the various flask related libraries as they use python decorators - and I don't have access to the Flask routes.
My solution would be to manually get the headers, and parse the authorization string manually. But I'm actually not to sure what format the Authorization follows - is there some library that can handle this complication for me?
flask google-cloud-platform google-cloud-build
flask google-cloud-platform google-cloud-build
asked Nov 16 '18 at 9:10
Chris StryczynskiChris Stryczynski
4,45453378
asked Nov 16 '18 at 9:10
Chris StryczynskiChris Stryczynski
4,45453378
asked Nov 16 '18 at 9:10
Chris StryczynskiChris Stryczynski
4,45453378
asked Nov 16 '18 at 9:10
Chris StryczynskiChris Stryczynski
4,45453378
asked Nov 16 '18 at 9:10
Chris StryczynskiChris Stryczynski
4,45453378
4,45453378
add a comment |
add a comment |
2 Answers
2
active
oldest
votes
requirements.txt:
basicauth==0.4.1
And the code:
from basicauth import decode
encoded_str = request.headers.get('Authorization')
username, password = decode(encoded_str)
if (username == "example", password == "*********"):
authed_request = True
answered Nov 16 '18 at 9:34
Chris StryczynskiChris Stryczynski
4,45453378
add a comment |
The Cloud Functions (CFs) are primarily designed for executing simple, standalone tasks, not complex applications.
The recommended CF access control method is based on service accounts and IAM. From Runtime service account:
At runtime, Cloud Functions uses the service account
PROJECT_ID@appspot.gserviceaccount.com, which has the Editor
role on the project. You can change the roles of this service account
to limit or extend the permissions for your running functions.
This access control method is enforced outside of the actual CF execution, so you don't need to worry about authentication in the CF code - you already know it can only be executed using the respective service account credentials.
Yes, it might be possible to use a custom authentication scheme similar to the one(s) use in more complex applications, but it won't be trivial - it's not what CFs were designed for. See the somehow related When to choose App Engine over Cloud Functions?
answered Nov 16 '18 at 10:46
Dan CornilescuDan Cornilescu
30k113767
The URL is publicly available - not sure how service accounts provide any authentication in this manner.
– Chris Stryczynski
Nov 16 '18 at 23:54
Ah, you mean on the ingress side. I imagine the IAM checks for thecloudfunctions.functions.callpermission is done at the CF trigger level. So if the trigger is HTTP, yes, the URL is public, but it's in the Google-ownedcloudfunctions.netdomain, so it's easy to do the IAM check after receiving the HTTP request but before actually invoking the CF. So you won't need to actually do anything inside the CF code itself, you just need to take care at configuring the CF and IAM roles and permissions.
– Dan Cornilescu
Nov 17 '18 at 4:10
I still don't understand why this has anything to do with HTTP's "Basic Access Authentication"?
– Chris Stryczynski
Nov 17 '18 at 9:16
I guess what I'm trying to say is that I see no point in attempting to parse/use the basic authentication info in the CF code. The info is either missing or static since a particular CF is always executed in a Google-curated environment, by the same identity/user.
– Dan Cornilescu
Nov 17 '18 at 14:13
It is sent in the HTTP request as an HTTP header - so with that I can check if it matches a username and password.
– Chris Stryczynski
Nov 17 '18 at 14:26
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53334636%2fhow-to-check-http-basic-auth-on-the-python-environment-of-google-cloud-functions%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
requirements.txt:
basicauth==0.4.1
And the code:
from basicauth import decode
encoded_str = request.headers.get('Authorization')
username, password = decode(encoded_str)
if (username == "example", password == "*********"):
authed_request = True
answered Nov 16 '18 at 9:34
Chris StryczynskiChris Stryczynski
4,45453378
add a comment |
requirements.txt:
basicauth==0.4.1
And the code:
from basicauth import decode
encoded_str = request.headers.get('Authorization')
username, password = decode(encoded_str)
if (username == "example", password == "*********"):
authed_request = True
answered Nov 16 '18 at 9:34
Chris StryczynskiChris Stryczynski
4,45453378
add a comment |
requirements.txt:
basicauth==0.4.1
And the code:
from basicauth import decode
encoded_str = request.headers.get('Authorization')
username, password = decode(encoded_str)
if (username == "example", password == "*********"):
authed_request = True
answered Nov 16 '18 at 9:34
Chris StryczynskiChris Stryczynski
4,45453378
requirements.txt:
basicauth==0.4.1
And the code:
from basicauth import decode
encoded_str = request.headers.get('Authorization')
username, password = decode(encoded_str)
if (username == "example", password == "*********"):
authed_request = True
answered Nov 16 '18 at 9:34
Chris StryczynskiChris Stryczynski
4,45453378
answered Nov 16 '18 at 9:34
Chris StryczynskiChris Stryczynski
4,45453378
answered Nov 16 '18 at 9:34
Chris StryczynskiChris Stryczynski
4,45453378
answered Nov 16 '18 at 9:34
Chris StryczynskiChris Stryczynski
4,45453378
4,45453378
add a comment |
add a comment |
The Cloud Functions (CFs) are primarily designed for executing simple, standalone tasks, not complex applications.
The recommended CF access control method is based on service accounts and IAM. From Runtime service account:
At runtime, Cloud Functions uses the service account
PROJECT_ID@appspot.gserviceaccount.com, which has the Editor
role on the project. You can change the roles of this service account
to limit or extend the permissions for your running functions.
This access control method is enforced outside of the actual CF execution, so you don't need to worry about authentication in the CF code - you already know it can only be executed using the respective service account credentials.
Yes, it might be possible to use a custom authentication scheme similar to the one(s) use in more complex applications, but it won't be trivial - it's not what CFs were designed for. See the somehow related When to choose App Engine over Cloud Functions?
answered Nov 16 '18 at 10:46
Dan CornilescuDan Cornilescu
30k113767
The URL is publicly available - not sure how service accounts provide any authentication in this manner.
– Chris Stryczynski
Nov 16 '18 at 23:54
Ah, you mean on the ingress side. I imagine the IAM checks for thecloudfunctions.functions.callpermission is done at the CF trigger level. So if the trigger is HTTP, yes, the URL is public, but it's in the Google-ownedcloudfunctions.netdomain, so it's easy to do the IAM check after receiving the HTTP request but before actually invoking the CF. So you won't need to actually do anything inside the CF code itself, you just need to take care at configuring the CF and IAM roles and permissions.
– Dan Cornilescu
Nov 17 '18 at 4:10
I still don't understand why this has anything to do with HTTP's "Basic Access Authentication"?
– Chris Stryczynski
Nov 17 '18 at 9:16
I guess what I'm trying to say is that I see no point in attempting to parse/use the basic authentication info in the CF code. The info is either missing or static since a particular CF is always executed in a Google-curated environment, by the same identity/user.
– Dan Cornilescu
Nov 17 '18 at 14:13
It is sent in the HTTP request as an HTTP header - so with that I can check if it matches a username and password.
– Chris Stryczynski
Nov 17 '18 at 14:26
add a comment |
The Cloud Functions (CFs) are primarily designed for executing simple, standalone tasks, not complex applications.
The recommended CF access control method is based on service accounts and IAM. From Runtime service account:
At runtime, Cloud Functions uses the service account
PROJECT_ID@appspot.gserviceaccount.com, which has the Editor
role on the project. You can change the roles of this service account
to limit or extend the permissions for your running functions.
This access control method is enforced outside of the actual CF execution, so you don't need to worry about authentication in the CF code - you already know it can only be executed using the respective service account credentials.
Yes, it might be possible to use a custom authentication scheme similar to the one(s) use in more complex applications, but it won't be trivial - it's not what CFs were designed for. See the somehow related When to choose App Engine over Cloud Functions?
answered Nov 16 '18 at 10:46
Dan CornilescuDan Cornilescu
30k113767
The URL is publicly available - not sure how service accounts provide any authentication in this manner.
– Chris Stryczynski
Nov 16 '18 at 23:54
Ah, you mean on the ingress side. I imagine the IAM checks for thecloudfunctions.functions.callpermission is done at the CF trigger level. So if the trigger is HTTP, yes, the URL is public, but it's in the Google-ownedcloudfunctions.netdomain, so it's easy to do the IAM check after receiving the HTTP request but before actually invoking the CF. So you won't need to actually do anything inside the CF code itself, you just need to take care at configuring the CF and IAM roles and permissions.
– Dan Cornilescu
Nov 17 '18 at 4:10
I still don't understand why this has anything to do with HTTP's "Basic Access Authentication"?
– Chris Stryczynski
Nov 17 '18 at 9:16
I guess what I'm trying to say is that I see no point in attempting to parse/use the basic authentication info in the CF code. The info is either missing or static since a particular CF is always executed in a Google-curated environment, by the same identity/user.
– Dan Cornilescu
Nov 17 '18 at 14:13
It is sent in the HTTP request as an HTTP header - so with that I can check if it matches a username and password.
– Chris Stryczynski
Nov 17 '18 at 14:26
add a comment |
The Cloud Functions (CFs) are primarily designed for executing simple, standalone tasks, not complex applications.
The recommended CF access control method is based on service accounts and IAM. From Runtime service account:
At runtime, Cloud Functions uses the service account
PROJECT_ID@appspot.gserviceaccount.com, which has the Editor
role on the project. You can change the roles of this service account
to limit or extend the permissions for your running functions.
This access control method is enforced outside of the actual CF execution, so you don't need to worry about authentication in the CF code - you already know it can only be executed using the respective service account credentials.
Yes, it might be possible to use a custom authentication scheme similar to the one(s) use in more complex applications, but it won't be trivial - it's not what CFs were designed for. See the somehow related When to choose App Engine over Cloud Functions?
answered Nov 16 '18 at 10:46
Dan CornilescuDan Cornilescu
30k113767
The Cloud Functions (CFs) are primarily designed for executing simple, standalone tasks, not complex applications.
The recommended CF access control method is based on service accounts and IAM. From Runtime service account:
At runtime, Cloud Functions uses the service account
PROJECT_ID@appspot.gserviceaccount.com, which has the Editor
role on the project. You can change the roles of this service account
to limit or extend the permissions for your running functions.
This access control method is enforced outside of the actual CF execution, so you don't need to worry about authentication in the CF code - you already know it can only be executed using the respective service account credentials.
Yes, it might be possible to use a custom authentication scheme similar to the one(s) use in more complex applications, but it won't be trivial - it's not what CFs were designed for. See the somehow related When to choose App Engine over Cloud Functions?
answered Nov 16 '18 at 10:46
Dan CornilescuDan Cornilescu
30k113767
answered Nov 16 '18 at 10:46
Dan CornilescuDan Cornilescu
30k113767
answered Nov 16 '18 at 10:46
Dan CornilescuDan Cornilescu
30k113767
answered Nov 16 '18 at 10:46
Dan CornilescuDan Cornilescu
30k113767
30k113767
The URL is publicly available - not sure how service accounts provide any authentication in this manner.
– Chris Stryczynski
Nov 16 '18 at 23:54
Ah, you mean on the ingress side. I imagine the IAM checks for thecloudfunctions.functions.callpermission is done at the CF trigger level. So if the trigger is HTTP, yes, the URL is public, but it's in the Google-ownedcloudfunctions.netdomain, so it's easy to do the IAM check after receiving the HTTP request but before actually invoking the CF. So you won't need to actually do anything inside the CF code itself, you just need to take care at configuring the CF and IAM roles and permissions.
– Dan Cornilescu
Nov 17 '18 at 4:10
I still don't understand why this has anything to do with HTTP's "Basic Access Authentication"?
– Chris Stryczynski
Nov 17 '18 at 9:16
I guess what I'm trying to say is that I see no point in attempting to parse/use the basic authentication info in the CF code. The info is either missing or static since a particular CF is always executed in a Google-curated environment, by the same identity/user.
– Dan Cornilescu
Nov 17 '18 at 14:13
It is sent in the HTTP request as an HTTP header - so with that I can check if it matches a username and password.
– Chris Stryczynski
Nov 17 '18 at 14:26
add a comment |
The URL is publicly available - not sure how service accounts provide any authentication in this manner.
– Chris Stryczynski
Nov 16 '18 at 23:54
Ah, you mean on the ingress side. I imagine the IAM checks for thecloudfunctions.functions.callpermission is done at the CF trigger level. So if the trigger is HTTP, yes, the URL is public, but it's in the Google-ownedcloudfunctions.netdomain, so it's easy to do the IAM check after receiving the HTTP request but before actually invoking the CF. So you won't need to actually do anything inside the CF code itself, you just need to take care at configuring the CF and IAM roles and permissions.
– Dan Cornilescu
Nov 17 '18 at 4:10
I still don't understand why this has anything to do with HTTP's "Basic Access Authentication"?
– Chris Stryczynski
Nov 17 '18 at 9:16
I guess what I'm trying to say is that I see no point in attempting to parse/use the basic authentication info in the CF code. The info is either missing or static since a particular CF is always executed in a Google-curated environment, by the same identity/user.
– Dan Cornilescu
Nov 17 '18 at 14:13
It is sent in the HTTP request as an HTTP header - so with that I can check if it matches a username and password.
– Chris Stryczynski
Nov 17 '18 at 14:26
The URL is publicly available - not sure how service accounts provide any authentication in this manner.
– Chris Stryczynski
Nov 16 '18 at 23:54
The URL is publicly available - not sure how service accounts provide any authentication in this manner.
– Chris Stryczynski
Nov 16 '18 at 23:54
Ah, you mean on the ingress side. I imagine the IAM checks for the
cloudfunctions.functions.call permission is done at the CF trigger level. So if the trigger is HTTP, yes, the URL is public, but it's in the Google-owned cloudfunctions.net domain, so it's easy to do the IAM check after receiving the HTTP request but before actually invoking the CF. So you won't need to actually do anything inside the CF code itself, you just need to take care at configuring the CF and IAM roles and permissions.– Dan Cornilescu
Nov 17 '18 at 4:10
Ah, you mean on the ingress side. I imagine the IAM checks for the
cloudfunctions.functions.call permission is done at the CF trigger level. So if the trigger is HTTP, yes, the URL is public, but it's in the Google-owned cloudfunctions.net domain, so it's easy to do the IAM check after receiving the HTTP request but before actually invoking the CF. So you won't need to actually do anything inside the CF code itself, you just need to take care at configuring the CF and IAM roles and permissions.– Dan Cornilescu
Nov 17 '18 at 4:10
I still don't understand why this has anything to do with HTTP's "Basic Access Authentication"?
– Chris Stryczynski
Nov 17 '18 at 9:16
I still don't understand why this has anything to do with HTTP's "Basic Access Authentication"?
– Chris Stryczynski
Nov 17 '18 at 9:16
I guess what I'm trying to say is that I see no point in attempting to parse/use the basic authentication info in the CF code. The info is either missing or static since a particular CF is always executed in a Google-curated environment, by the same identity/user.
– Dan Cornilescu
Nov 17 '18 at 14:13
I guess what I'm trying to say is that I see no point in attempting to parse/use the basic authentication info in the CF code. The info is either missing or static since a particular CF is always executed in a Google-curated environment, by the same identity/user.
– Dan Cornilescu
Nov 17 '18 at 14:13
It is sent in the HTTP request as an HTTP header - so with that I can check if it matches a username and password.
– Chris Stryczynski
Nov 17 '18 at 14:26
It is sent in the HTTP request as an HTTP header - so with that I can check if it matches a username and password.
– Chris Stryczynski
Nov 17 '18 at 14:26
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53334636%2fhow-to-check-http-basic-auth-on-the-python-environment-of-google-cloud-functions%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
