Flask中安全传递JWT：重定向场景下的HttpOnly Cookie实践

import jwt
import datetime
from flask import Flask, redirect, url_for, make_response, request

# 假设你已经定义了SECRET、数据库操作等
SECRET = "your_super_secret_key" # 在生产环境中应从环境变量获取
app = Flask(__name__)

# 模拟数据库操作和用户ID生成
def generate_customer_id():
    return "user_" + str(datetime.datetime.now().timestamp()).replace('.', '')

def store_customer_in_db(cid, hashed_passwd):
    # 模拟存储到数据库
    print(f"Storing user {cid} with hashed password {hashed_passwd} in DB.")
    return True

@app.route('/signup', methods=['POST'])
def signup():
    # 假设从请求中获取用户名和密码
    username = request.form.get('username')
    password = request.form.get('password')

    if not username or not password:
        return "Username and password are required", 400

    # 模拟用户注册和密码哈希
    cid = generate_customer_id()
    hashed_passwd = f"hashed_{password}" # 实际应用中请使用安全的哈希算法如bcrypt

    try:
        # 模拟数据库操作
        if not store_customer_in_db(cid, hashed_passwd):
            raise Exception("Failed to store user in DB")

        payload = {
            'cid': cid,
            'exp': datetime.datetime.utcnow() + datetime.timedelta(minutes=30) # 令牌30分钟后过期
        }

        token = jwt.encode(payload, SECRET, algorithm='HS256')

        # 创建重定向响应
        redirect_url = url_for('order_page') # 使用url_for生成目标URL
        response = make_response(redirect(redirect_url))

        # 设置HttpOnly、Secure、SameSite Cookie
        # token.decode('utf-8') 是因为 jwt.encode 返回的是 bytes
        response.set_cookie(
            'jwt_token', 
            token, 
            httponly=True, 
            secure=True, # 在生产环境中必须设置为True，本地测试可暂时设置为False
            samesite='Lax', # 根据需求选择Strict或Lax
            max_age=datetime.timedelta(minutes=30).total_seconds() # Cookie过期时间与JWT过期时间一致
        )

        return response

    except Exception as err:
        print(f"Error during signup: {err}")
        return "Signup failed", 500

@app.route('/order')
def order_page():
    # 从Cookie中获取JWT令牌
    token = request.cookies.get('jwt_token')

    if not token:
        return "Unauthorized: No JWT token found in cookies", 401

    try:
        # 验证JWT令牌
        decoded_payload = jwt.decode(token, SECRET, algorithms=['HS256'])
        cid = decoded_payload.get('cid')

        return f"Welcome to the orders page, user {cid}! Your token is valid."

    except jwt.ExpiredSignatureError:
        return "Unauthorized: JWT token has expired", 401
    except jwt.InvalidTokenError:
        return "Unauthorized: Invalid JWT token", 401

if __name__ == '__main__':
    # 仅用于本地测试，生产环境应使用WSGI服务器
    app.run(debug=True, ssl_context='adhoc') # 使用adhoc SSL上下文方便本地测试Secure Cookie