mirror of
https://github.com/dcs-liberation/dcs_liberation.git
synced 2025-11-10 14:22:26 +00:00
77d29e314c
We don't have any sensitive data, but we do access the file system. On the off chance that some phishing website decides to try to use Liberation as an attack vector, prevent access to the API by unauthorized applications. An API key is generated at each program start and passed to the front end via the QWebChannel.
16 lines
420 B
Python
16 lines
420 B
Python
import secrets
|
|
|
|
from fastapi import HTTPException, Security, status
|
|
from fastapi.security import APIKeyHeader
|
|
|
|
API_KEY_HEADER = APIKeyHeader(name="X-API-Key")
|
|
|
|
|
|
class ApiKeyManager:
|
|
KEY = secrets.token_urlsafe()
|
|
|
|
@classmethod
|
|
def verify(cls, api_key_header: str = Security(API_KEY_HEADER)) -> None:
|
|
if api_key_header != cls.KEY:
|
|
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN)
|