APP安全双十一促销活动

from flask import Flask, request, jsonify
from flask_httpauth import HTTPBasicAuth
from werkzeug.security import generate_password_hash, check_password_hash
import jwt
import datetime

app = Flask(__name__)
auth = HTTPBasicAuth()

users = {
    "user1": generate_password_hash("password1"),
    "user2": generate_password_hash("password2")
}

@auth.verify_password
def verify_password(username, password):
    if username in users and check_password_hash(users.get(username), password):
        return username

@app.route('/login')
@auth.login_required
def login():
    token = jwt.encode({
        'user': auth.current_user(),
        'exp': datetime.datetime.utcnow() + datetime.timedelta(minutes=30)
    }, 'secret_key', algorithm='HS256')
    return jsonify({'token': token})

@app.route('/protected')
def protected():
    token = request.headers.get('Authorization')
    if not token:
        return jsonify({'message': 'Token is missing'}), 401
    try:
        data = jwt.decode(token, 'secret_key', algorithms=['HS256'])
        return jsonify({'message': f'Hello, {data["user"]}!'})
    except:
        return jsonify({'message': 'Token is invalid'}), 401

if __name__ == '__main__':
    app.run(debug=True)