Flask-Allow

Flask-Allow is an extension for Flask that adds support for white and/or black listing IP addresses and/or IP networks and provide an access log to your application.

Why this extension

Whenever the web application runs behind a reverse proxy that is located on a different system in the network, you want to grant access to the proxy but exclude all other hosts in the network.

ALLOW:  proxy-host.your.domain.tld
ALLOW:  localhost
DENY:   0.0.0.0/0

These rules allow the host proxy-host.your.domain.tld and localhost to pass in to the web application. localhost is there to give administrators access to the web application when running on the same machine. The 0.0.0.0/0 blocks all other addresses.

Not the order in which you configure the rules is important. for example swaping localhost and 0.0.0.0/0 shall exclude the localhost.

Why should you use a reverse proxy, read all about it in the Link

Version

Currently this supports and is tested with Flask 2.x.x. therefore the version of this package is version 2.0.x. Tested with Python version 3.8, 3.9, 3.10 and 3.11.

Licence

Flask-Allow is licenced under GPL-2.0-only, see the LICENCE.md for more information.

Installing

Install and update using pip.

    $ pip install -U Flask-Allow

Configuration

This extension has two configuration items:

• ADDRESS_RESTRICTION
• ACCESS_LOG

The attribute ADDRESS_RESTRICTION is a list of dictionaries with one or two items

• ALLOW; the IP address or network address to be granted access.
• DENY; the IP address or network address to be denied access.

For IP network addresses it must be coded as /, for example:

172.16.0.0/16

For allowing or denying single hosts you may even write the fqdn of the host you want to exclude;

DENY: test.example.com
ALLOW: prod.example.com

The attribute ACCESS_LOG may be a filename or a dictionary, it uses rotating file logger. When using a dictionary the following items may be provided;

• filename; sets the filename for the access log.
• maxBytes; sets the maximum size of the log file, default is 5242880.
• backupCount; sets the maximum historical log files kept, default is 7.
• formatter; Sets the log file formatter, default is "%(asctime)s - %(levelname)7s - %(message)s"

The logger created is called flask.allow, when configured the log level is set the INFO.

Simple example

The following example sets up a web server on host address 0.0.0.0 (all networks) with port 5000. An access log is created and only the localhost address is allowed to enter the application, all other addresses receive a HTTP 403 error.

import flask
from flask_allow import FlaskAllow

app = flask.Flask( __name__ )
app.config[ 'ACCESS_LOG' ]  = "access.log"
app.config[ 'ADDRESS_RESTRICTION' ] = [
    {
        "ALLOW":    "127.0.0.1",             # Allow localhost
        "DENY":     "0.0.0.0/0"              # Deny the rest
    }
]
FlaskAllow( app )

@app.route('/')
def index():
    return "Hello world", 200

app.run( '0.0.0.0', 5000 )
    

NOTE: The class FlaskAllow should be initialized before any @before_request decorators are being called, this to ensure that Flask-Allow is the first to check in incomming request.

The following log output is from the test_flask_allow.py script.

2023-12-03 07:34:27,883 -    INFO - Access log started
2023-12-03 07:34:28,886 -    INFO - 127.0.0.1 allowed by rule 127.0.0.1/32 http://localhost:5000/ 
2023-12-03 07:34:28,893 -    INFO - 127.0.0.1 allowed by rule 127.0.0.1/32 http://localhost:5000/ python-requests/2.31.0
2023-12-03 07:34:28,903 -   ERROR - 192.168.110.2 denied by rule 0.0.0.0/0 http://matrix:5000/ python-requests/2.31.0

Contributing

For guidance on setting up a development environment and how to make a contribution to flask-access, see the contributing guidelines.

Donate

The Pallets organization develops and supports Flask and other popular packages. In order to grow the community of contributors and users, and allow the maintainers to devote more time to the projects, please donate today

Links

• Changes
• PyPI Releases
• Source Code
• Issue Tracker
• Website