Secure python rest API with azure AD

Question

I have some python rest API that i would like to protect with azure AD. To do so I was thinking to validate the bearer token for each request according to the example: https://github.com/Azure-Samples/ms-identity-python-webapi-azurefunctions.

Is that the correct approach? What is the best practice? There is not a simpler way to managing sessions ? Something similar to flask-login but for APIs (i.e. something not based on session cookies)?

Thank you Riccardo

Joy Wang · Accepted Answer · 2020-05-26 02:03:32Z

3

Is that the correct approach? What is the best practice?

Yes, it is correct, and it should be the best pratice(at least I can find). To protect the APIs with Azure AD, you always need to register an AD App for it, expose the APIs, then in your client app, add the API permission, the user login and consent the permission, get the token and call the API.

There is not a simpler way to managing sessions? Something similar to flask-login but for APIs (i.e. something not based on session cookies)?

As far as I know, there is no such thing similar to flask-login for APIs.

answered May 26, 2020 at 2:03

Joy Wang

42.4k3 gold badges38 silver badges64 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Secure python rest API with azure AD

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related