I'm working on a flask application which requires some authentication but not on every endpoint. I use this piece of code to exclude certain endpoints from my authentication handler.
if request.path in NO_AUTH_PATHS or (re.match(r'/dashboard/.*', request.path) is not None): return None
I then though what would happen if i were to make a call to
Fortunately I got an authentication error, and I made the call both via my browser (Firefox 71.0) and through curl v7.67. This leads me to believe that
request.path is parsed as
/<restricted_path> and not
What I want to ask is where this parsing takes place? If it's done by curl and Firefox before forwarding the request, this method might be a huge security issue.