Repository navigation
Flask: support the Bottle-only configs (plugins/JWT auth, enable_cors, publish_swagger, openapi_insecure) #42
Description
Split from #40 (items 1-3 are fixed in the PR for #40). Under framework='flask' these configs are refused with NotImplementedError rather than dropped. The real work: a Flask equivalent of JWTPlugin/ApiKeyAuthPlugin (a before_request hook reusing the checks of py2http.auth, with ping/openapi public unless openapi_insecure), CORS (after_request + OPTIONS routes), and swagger. Note py2http.middleware is aiohttp-only and the plugins use Bottle's request/response, so neither carries over as is. Auth is security-sensitive: needs an adversarial review.
Activity
thorwhalen commentedon Oct 13, 2026
From the review of #43, also left open: under Flask an async output mapper with a
content_type, or one returning a(body, status)tuple, still answers text/html (flask_response_mapperis sync and passes those through); several files under one form field keep only the first; Flask reads bodies with no size limit (Bottle capped at ~100KB).Flask: plugins (JWT/API-key auth), enable_cors, publish_swagger, open…