from flask import abort
from flask_jwt_extended import current_user
@app.route('/users/<userid:int>/edit')
@jwt_required
def users_edit(userid):
if userid != current_user.id:
abort(403)
# ... handle view for matching userfrom functools import wraps
from flask_jwt_extended import current_user, jwt_protected
def userid_must_match(f):
"""Abort with a 403 Forbidden if the userid doesn't match the jwt token
This decorator adds the @protected decorator
Checks for a `userid` parameter to the function and aborts with
status code 403 if this doesn't match the user identified by the
token.
"""
@wraps(f)
@jwt_protected
def wrapper(*args, userid=None, **kwargs):
if userid is not None and userid != current_user.id:
abort(403)
return f(*args, **kwargs)
return wrapperfrom flask import abort
from flask_jwt_extended import current_user
@app.route('/users/edit')
@app.route('/users/<userid:int>/edit')
@userid_must_match
def users_edit():
# ... handle view for matching user via current_user# assuming that the sub claim is an integer value
if userid != get_jwt_identity()@app.route('/users/<userid:int>/edit')
@userid_must_match
def users_edit():
# ... handle view for matching user