Advanced Flask Patterns

0 0

so this is what it looks like analysis your content which is actually not yet released but I want to get around this next week around France currently is fast to the application context so once there is an application context you can figure out what's my current application for us but she s of C R my temp is also bound to the other Asian context and the question section belonged to the request context because they kind of go together with what is an HTTP request and roughly it works like this application comics are really fast afraid in Australia so you should be using them if you don't need Asian University and if you create if you push your request context you miss it they also push an application context so if you have to use the with test request pontiff's construct in the past it will now magically also create an application context for you and she finds out to eat appreciation colors now this is just a rough overview of how this whole state management across works the rest of the presentation kind of assumes that we have a rough understand how these things go together so sl-class here content or limited degree acid process to part 9 the all the resources are supposed to be polished to get vacation context all right so this is roughly what works for you create in the stratification Kanta every time you learn anything out of the box if you do handle an HTTP request if you have an F brought it will automatically create and destroy and a request an application context for you so you don't even have to deal with any of this we have the same stuff however not every HTTP evocation is actually just responding to browser requests a good example is you have a script that creates your database matches your database tables and for the duration of that script you you want to have a database connection so you can actually modify something in other case you can create this application context and then you have public functions that will populate a database connection on to this onto this application context and time you do something and when you destroyed a context of alright you destroy to make sure that go with it so in order to see how this works there's a little bit of it for example if you create an application object there is a decorator functionality called TMF context and this decorator can be used to register function call of X with the application and every time the application context destroys all of this function X security in case the execution works without a problem it will it has none so to indicate there is not an error if it tears down because of an exception that there will be first round of error right there so if you create it by hand with the CTX equals and that push it in puppets you can see the handle was executed with era if you do it in a winter ball and that's with rock throw nades for some exceptions because it's an era you will see that you did here now this is a very useful travel concept so young the theorem hunters are always called if you pop the application colors now in frost itself that for American happens out of the box at the end of the request so one thing you can find the stories you can find your database connections automatically and on first usage so you can have a function called get the others connection check if there is already a database connection IMG object if there is no connection on it or create one until remember it and then the perfect round attraction now at the end of the request it will do the same thing if there is actually a database connection they both close it or return it to the poles so in this case the first time you actually use a datum is actually it will remember it keep it around for for as long as necessary and that might get destroyed a context it goes away and this resource management can be further improved from there for instance for database connections that are traditional relational databases there is there are two cases one is I want to commit my stuff the other case is I want to roll back that was an exception you can automatically do this because the error is asked to be feared Hingham function so in this case if there is an error it will if there is not inheritable if there's a narrative we'll roll back and then they overuse the connection is this this general concept roughly have you used something like this with us before all right very sorry right so for instance class has helped me does this be like the seats automatically for you or or other class extensions already couple these pieces of quotes for you behind the scenes so you don't have to be with it but the channel concept is filled are usable for instance if you use how many to use the requests library display requests is basically similar to a higher elevation step has a nice interface so you can do an HTTP request as well stable things now if you do a lot of HTTP requests to the same server you can reuse the TCP socket behind the scenes so that you don't have to do the TCP handshake over again and request for a lot of money to do this for you and the way this works on request is you create a session object and then you can keep that subject around and for as long as the session object exists it will keep the connections in there so for instance you can create the session at the beginning of the request and then at the end of the request excitable Tina this is something I use very often on top of cyclic me it's like somewhat a conversion which is the idea of an one commit call back now imagine you have a shot so let me just show you what is worse it remembers Elizabeth Kovacs on the she object that's basic what it does now the way it could be implemented is that if hope you hear some people check if it does committee the committee this is list of callbacks that executed is bollocks now if you have ever written an application that does some sort of transaction processing like an online store where you can buy a product and then that FERC is bound to you and you own that product your comments apart and then you want to send the mail to the customer that cannot witness this option is this product in a store and is a small chance always that the database will not go through properly so they could be an exception happening because it was the radius connection or if there was some sort of other area was happening now one thing you don't want to do is you don't want to send the mail out to the customer that he owns the product before the product is actually in database is that doesn't very good experience with the customer but because it commits happens at the end of the request this is actually have an outside of the scope of your function so in a purchase function if you would sense direct to your stalkers they want action out of boxes you commit your transaction in there and tell me something about option two is you sent the email and then returned in the function in which case if an error happens afterwards the customer already got the email that he owns the product when in reality it wasn't also error now if you have like this smaller of the committee decorator you can update get it erased so in this case this would see quality and it says hence my products that are no more purchase products this user has and then it will remember a function to execute when the transaction commits after the transaction commits in this case if the commit actually went through if the whole thing tears down it will send an email for you so this is just one of the things you can do with when you have a list of callbacks on the cracker crust so you can get their code execution until the point where you're happy with it happening automatically the second thing I want to talk about this up is responsive creation now you can use if you use a cross by the tutorial you don't even know that there are response objects be creative because one thing you do is you write a function and it returns a string and then all the sudden days maybe be responsive the way this works across is it will automatically work for you and you can replace this response object over and over again with others by important part is there is no crosswalk response what is there actually is there's a response class you can instantiate or is automatically instantiate it for you so I suppose you have seen this example it's so where's the response object in Freya's regular screen with render template that has a string now what's happening is that class internally on the main object has a callback function is executed which will check the return value if you get a certain number of types and then if it sees a type it recognizes it will automatically create a response object for you so the default behaviour if you return a string it will create a responsible for you with that 4,200 okay as an error code and/or status code and then text HTML as content so what do you do if you want to add a custom header to this option one is to do this you're too funny for main response and then you wrap your return value in which that make response and you get response object in the body plan eternity you can like to check will create the response object yourself I have that more declare that return yellow you have is you can actually customize the behavior of slots will create force on subjects for you so one example here is some if you do a lot of AP ice you might returned a lot of chaste objects one thing you could do is you can say all right if I'm returning an object from the function and that object has a certain function on it turn around and compared to chasing it should already know this so principle is bethere accustomed passed some to us which overrides the main response function which is provided for across eternity and it will check is there and as we go to chase manage and then we'll execute it and then it will automatically the phase response so then all the sudden all different functional changes in the regular kind of user object and we automated create the chasing response for you now the reason why this is interesting is because one thing you can't really do now based on the objects they were coming instead of actually looking at the whole HTTP response so if your unit test event just executes the function and it returns and a user object that you can check if the user object looks like what you expect it to be so you can think there's some very proper testing this way you'd still do testing on axle the tongue values from an API query point it might make sense for certain number of publications all right the next part which is one thing I I like a lot because of how how interesting things you can do is very little work is server sent events now I want to know how many of you are actually doing some sort of includes real-time application where user interface updates based on changes on the server side automatically I that's not about people so maybe there is something interesting here in this one I do do you know the concept of a service site event it's it's called is a feature of html5 it's also called event source it's it's about a server push it's a very trivial way it works with any ways be server it works better with some others and it's it's basically an it's getting real-time applications when we put with basically 20 lines of code and it's pretty simple so roughly this is my words they find almost socket and the server sends data and data to UV lights so the data Collins white space that a nice way and then two new lines and then every time the server sense this the clients automatic updated so you basic just keep a soccer for a long time and that JavaScript code can read from the socket if it already do this before that source but think that source gives you a nice idea for it this works really well with she meant and she unicorn s your whiskey server because one thing they do really well is keeping tons of sohcahtoa if you use a more traditional web server to write down what Thomas GI every subject in Kibo you keeps all of this right around so that's quite expensive but one thing you can nicely do with this is you can have one part of the application being served by key unique one here application being served by it well maybe also to unique - well but it's also service room what does giant menu pretension X on top and then we unify these two very different principles so I don't know if you notice this but she meant is that we need by choice if you want to move databases because if you keep a high number of connections open to the client site and each of these connection keeps international to a database then while the sudden Postgres won't terminate because you have too many database connections for post-crisis what that program does not exist if you do your traditional application that talks to the database in which certain workers and what I was jolly or 20 workers into your department so the total number of database connection to capital to 20 and then you do like high concurrency to the client was like 2005 sitting there waiting for a socket with your so then this is basically how you can do service and events with Wells any whiskey server in whatever like 50 knots of code even we can add winter cold streams interesting process and in there there's a generator like the regular type of generator and here I'm using something in Venice called subscriptions or you create this pops of objects and then we say I am interested in this interesting Channel and then every time there is an event in this channel and the events of that message I'm sending this to the client and then the way is create these responses you use streamers context which is a function in class which will just keep your context subject around collaboration its generator and then you say that password equals true that's necessary so that no buffering is happening anywhere out of the way of the Destroyers behavior and then we said the Maglev detects event stream and so now all you have to do is to notify clients I want to change and server this you have to put something and you have to publish something to this register so you have another function call to create something when you create a thing and that you publish a new education that you create a thing into the interesting channel on there twice I only have to do is there is a function called event source and every time event data is in that in that stream you at this you can do this arbitrary complex you can have one channel user you can have interest group so funny thing is that's one thing you can't really do this you make a pastebin and each pace has so each piece of code geography as a unitary unit so you have one channel for each of these of these and then every time an update comes in on on the pace because some are the comment or did a notification on it you just sent an update into this Redis channel and everybody who is listening on it well I'm going to see hate it was what if you get from this so there's this problem that's why people typically did not necessarily do that was fast Boston as mentioned before she unicorn is it's not a good idea or like a userspace concurrency model it's - see that - currencies have an idea to meet recidivism but if you look at what this actually does the only database access that's happening here is a Redis and Redis is optimized for Hydra currency well it's it's really fast like the transition so nothing in here is doing anything with the database so it does talk to write about going ready today there is quite a stretch so nothing here ever authenticated user nothing new Christ Postgres so this partly contributed keep you gue Park and the rest to keep in you WI so this you can be achieved by doing some very basic purpose operation the way you can Buddhist is you have a supervisor convict and you started yet repeated twice once you started up with support for processes and 14,000 and then you started again four times but with the achievement worker which is optimized for like a currency and then all you have to do is you have to go to into next CRM for those dreams goes to the one that cycle current and the other one goes to your regular benefits of the application so see how this concept can be applied I really really like which I don't know why I have a sorry abusing this before it with the system probably my most favorite piece of thing or idea or concept I have seen I know we just stay here you don't actually store anything you just pretend it's there and you send it around over the wire it just make sure nobody modifies the data so you know how poisons use activation usually involves sending someone a random number and then that random number has to come back and then activity is apropos I suppose you have written this reports on sign up you simply use an email and the email contains a link and if you follow that link the user account is activated now the downside of this is you have to keep all of its codes around so each user can I have this quote you've read it once and when Ithaca is redeemed its reduction with user account now is the user context simple because the number of users who have a spy not every user account activation codes so you just remember the condition for Davis there are certain things that you do in computing that generates many more of these stories a good example is or now with or every time you authorize against the main point you generate a piece of tofu now there are two options you can do this you remember those tokens and that may be return the same talk was over and over again option two is you create an infinite number of these tones and you don't remember that we just remember how to validate and the way you can do this wisdom was privately Swiss TM is dangerous module which is basically just a real implementation of how this works and Django just that it doesn't depend on any internal stuff and it it simplifies the interface of how is how you can actually use this for Sammy so basically it saves you from storing stuff in the database it just sent a piece of information across on the internet and you verify at the end that nobody tampered with your data tokens or other things in fact if you use a session in flask that century is not stored on the server that session is sent in the cookie right and it's just signs that nobody can modify the Skookum so if the user sees like if you store is is at man nobody can flip this to true or false because it would belly it would validate the signature and the signature can only be generated by the server side because it requires a piece of knowledge who's the secret key which the client is Cal so a very trivial way of doing that would be you create a URL six serializer of the his dangerous module and you pass it the secret key now the secret key really a good way to generate the secret keys is to use the Yeosu random function which just reads a bunch of lights out of your operating system entropy buffer and then you remember that second taking and then you can turn to the right and modify here of this by adding a little bit of salt random numbers again now one thing you're on there is why you want to give the salts separately is for instance someone leaked and you know someone lost is someone needs a little bit of information you want to invalidate all of these links at the one at the same time so all you have to do is invalidate anything the serialize has ever created to modify his reputation salty then all the all the tokens ever chariots apart immediately invalid so the way you would do this activation link is to say to the serializer dummy the user ID was dissolved in to be activated URL so the activation URL and have a random number of bytes at the end and this random number quite speak what's on party fragments the signature and then after the signature that is an encoded payload so the user you say is 42 the activation link would be some random numbers plus the number 42 in your electorate and then all we have to do check with users you know that as bad as someone what if I could it will work is for otherwise yeah actually my user was the ID now in this case the token is valid for indefinite amount of time so you connect the reddit user account four times that's not a problem because an activate user account cannot be reactivated but if you want to do this definitely you just need to put more information in so for instance one thing you can do is you can not just a story use ID there you can also store a time step in there so you would say realize they use ID plus the timestamp then when you activate to check if the times that is still within the realm of what's reasonable so for instance it would not activate the user if the ladies over that day if you really want to go to the point of where you only activates and exactly once you could store a piece of information in the token that you can then validate that actually change what I mean by that is for instance password changes usually have a string you simply either click the link and then you can change your password and the way you could do this is by putting an md5 hash a truncated version of the md5 hash of the password of the user into the activation link so if the user actually changes the password that message changes and which that evening comes about and so that that would be one option to put more information into into the serialization system any one of you I will use something like this instead of storing our layers all right if you don't want to use the distinct first one so I know a lot of you are doing Chango what's called changes and signing is so tango you could tell signing is is a modular chamber roughly versus it's a little bit more degraded into you could check context so you have to set up your cookies but yeah you can use fast the current versions of us depend on this module so it's automatically available just input this dangerous go ahead and sign stuff it's reasonable so the last thing I want to talk about is its customization in flask itself now this does not really correspond to all that much to other frameworks I suppose but the way flask is written is every single function doesn't have an illusive on the front it's intended to you can actually override it so you can go to your application object and say I want to override the way for instance responses are created as a chunk before so you have a mate response function you can modify this by overriding unless a function is marks especially has done the overrides or has been leading-- underscore and you can pretty much customize any sort of behavior right here I don't have any kinds of changing so everything if you see the documentation is you can override it just all right it's not just functions that we can modify this way there are also poker points directly across that let the customers behavior a good example here is you know how HTTP caches can be quite annoying and just keep your study resources around for way longer than you have anticipated a cousin a trick that comes up quite often is you put random number of strings at the ends of your URL I've done because the URL changes every time you do a server did all your resources become combative but you have to remember that every time you generate a URL to the static resource you actually to this random number of strings behind so one hook point Winston skin plus zero equals which is a function you can register a function that this will be execute every time we've generated URL so for instance in this case it checks if the study which in this case would be so if you do a URL for static file name is something but I mean you get enough question mark underscore B equals random string so at that point you no longer have to worry about it just do a server updates and all your study they're there many more points we can override behavior within flask to customize the obvious ones have all the function decorators but you can't just override pretty much anything for instance one thing you can do it mask is you can replace your request and response object to different implementations so one thing are more and more people are discovering is that frost will or imagine Parsifal beta which is useful because you get to your home data request but sometimes you want to interface with a library there's very specific requirements on the request Dale so for instance I don't know have you ever used people integrate as people they have this really annoying API where the order of incoming parameters matters so there are a lot ready-made libraries that's already deal with this but when the archetype or for that matter flask parses you put there it will be put into a dictionary and as we are dictionaries loose the order so one thing you can do is something like this you can just request object you say I don't want my computer parts there's a parameter customize this behavior and now every time I request comes in it will be off that custom subclass and because it can flag the flag for me the part is flipped it will not actually post it from there anymore the reason they are you posting is anonymous here is there's a default property on the Plus request object called data which if you access it will read all the data to string which can be quite annoying especially if the coming day is quite large so you can just disable at the same vehicles now I think you vote on accidentally read-only data into a string so yeah there's a lot of customization with points on it every time you see some sort of behavior you wish it would be different check if there is already a way you customize this behavior and if not put a feature request up for it because I I don't like the idea of having to run a modified version of a library who still files and everything it should be possible to customize this out-of-the-box to the degree if necessary this is just a little bit of mixer thing in there which is are we too large to have on a slide but the idea of redirected into an arbitrary domain is quite risky so you know how you most websites cataloging form and then it redirects you somewhere the typical trick is to have the next parameter in that URL that says once you sign in go back to that whatever step you came from or if someone puts this little comment there and Google will then be redirected to Disney Kong user to be redirected to this name would be quite obvious for customers to see that this is like another web so they wanted a lock but if someone who puts a website in the place that looks exactly like your website just slightly different URL it's a very nice way to fish off users credentials so a very simple way to do this for the slights is to have the sponsible to safety or alchemy so the way you can't really do this appointment is you have this URL course module which parses URLs into small parts and then the part is your request URL and then you parse this against a URL that's being passed in and then you check if this is actually from the same process you're a president so if this is on a different machine already and then also one thing that's quite annoying is people actually are on the password reset page and they do something with it and then managed to create this redirect loop because the page redirects itself you want to avoid this as well and if it's a different URL and it's a safe URL this we don't make make function will return back to this page otherwise it will go to their format before way you could place it in this case you can say return redirected to URL or index which means well redirect back to the page you came from or if that page is unsafe or the page is actually the same page as you are currently or I don't know where to redirect me to it will redirect into the fallback I actually I want to put this into somewhere but it's like this is really all unnecessary and you have safe redirected thing going on the other thing is here those passports get next which if you change this to request values get next then it will check post the URL parameters as well as phone data so one thing you can then trivially do is you can remember the next target in your form so every time the user does not remember his password from the attempts of times of attempts over and over again it will not actually who's where the users being redirected to you can give them even go further and say oh and I have forgotten my password and you put that next to your line there and so the user never actually loses track of what he was at this website all right that's um that's as far as Paris in his presentation goes I am more than happy to have an extended Q&A in regards to whatever questions you have you know to decorate who would I suppress propagating an exception down to say if you can from this theorem decorator suppress an error that would otherwise be generated quite responsible so if any of these are the two functions one is tear down tear down functions are executed when we destroy application context now this concept generally does not correspond to an HTTP request so while it might often occur as part of an HTTP requests there are other reasons first up there's second function called after request now which will get the same parameters but it will not be executed in Paris tomorrow so that is one way to customize behavior the third option you have to customize especially the error case is there something called app era member where you can pass in an exception objective and then every time an exception of that error is being created you can return different responses we are for instance using this if there are any term exception called service unavailable which is raised by database connections not being there or anything of that sort which will then automatically be generated into a nice user visible oh sorry we're in maintenance mode or I can't see but actually just to give him a beer parties would be too much so the same way you can have a 4/4 in here you can also put them any exception clause in there so you can have like a database and then return something else yep I have a question about timing if you have a secret key for example it's not so secret anymore and if you have our URLs as they don't work it was a good practice to change secret key so for starters the the most important part there is no floozie secret key which sons were to do but actually the material people don't lose the secret key now there is just one case that comes up very often that's actually the only time I ever heard a reason one reason why you lose your cookies because you have an open source project and you put your code to get up and you see your keys in there so for that reason I strongly recommend loading the secret key from a secretary file which is you can't ignore you don't ever put this anywhere so that the most important is not losing your key if you did lose your secret key change it as quickly as possible and make up a press statement that says form URLs or pro principles because if I if you would support the old key is still at that point for trace period that would be obviously not possibility so one thing you could do is every time you you're loading your sine-theta you have a list of keys so you know the old key is still valid for five days to try to read this first so you try to mute it first if that fails you try the old key check if the old key is still within the grace period and then you know the old key the problem there is that it's really struggling with burning things because if your secret P is known to be leaked then they can pretty much modify anything Automation which is a huge security risk so at that point I would not have a grace period I just make sure I don't lose the key again and deal with properties now the the obvious result of the system every time I have anything site I have a way to regenerate this information necessary so if a user if the user customer sub make it becomes a balance because I have to change a secret key there will be a link somewhere website going to do this again same thing with all stones if if I expire your token or they invalidated told me there is a way for you to get any coverage so I never put anything into a science piece of information which I couldn't by other means so as long as I used flasks I always had a question about why we need an application step in the first place in most use cases we don't need more than one application that is associated to the current progress aside from as you said unit testing can you put up a Nia's scenario well where we will need to use more than one application and in snake manner so there is why you would want to have more than one application in the absence of unit tests is is actually in the documentation on the pennant so things I actually the previous off the kisses actually shows this court hall I think it's in here so so one case I think it's in here somewhere well this is actually this is quite confusing to see but it shows a little bit so one example where it's interesting to have more than one application is if you have customers I didn't press my question well I understand why I will why we'll need more than one application the question is where we need you to use this tag for this oh wait are you stuck instead of just days so the reason why I suspect instead of justice protocol is mostly saggy so you don't actually accidentally leak something out so if there wouldn't be a stack and so this see the push contacts do something with the pop context guarantees isolation for starters so you don't exit so one thing I I had respect locals before which why I hated them is you run your thing and then give them clean up properly and you leave a reference to that stuff we did before hanging around which is especially bad when it comes to multiple users there was an exploit against one type of framework where the threat levels went up quinta properly so if you knew what you were doing you could go to the right endpoint and you saw the last uses compeition because that music was still on sitting around on a stack so the spec solves first of all it it very clearly terminates the lifetime of this information and secondly sometimes you want to do with interlock switch to a length user so this is why I want to show this example here so we do this sort of dip in our code base just not not direct in a whisky level we have multiple customers and we have one application with a special which is an internal application where you sign on with an especially user account and you can create more application yourself and this special application switches context to the other application as necessary so you can sign your sign into this management website you maintain other websites and some of these API calls have tomalak some of these calls have to modify data in our database so they will put their will temporarily switch work over to the dollar application who stuff there and then destroyed and there's very easy to do with a spec it's not as easy to do if you have to keep the reference result there's work being done by someone which is really the only thing that blocks it because flask itself if you import it in ficus tree if it wouldn't be for some syntax errors it will work because mask is so high level that they don't even problem solved it already speaks to echo 322 so nothing really changes there the problem is parts of itself and the the main pump there is anyone using fight through myself so I didn't put it over but yes someone is working on it and I want to see if I can merge this in soon if so be honest my main problem of why I haven't done any work on this is I have in my mind that the N and that number might be wrong now but certainly last I was looking at the vast majority of users that would use this thing are running on fire - now now because the vested library is so low level it did make certain assumptions in regards to obviously works which are no longer true lacustrine so the moment I look important three I will have to break the API for Piper two users if I want to have the same overall experience at which point I will annoying a bunch of users to have to change the code for what accused we have a reason so I don't have a solution for this yet there is there was a court of all points which I couldn't question but that would have actually have cost in equal commerce of mine three there's another part that somewhat done which changes Apio 5/2 and it's basically a matter of finding a nice migration path or for everybody to do it because there are a little bit like the moment the point is to attachments they will have to be changed for Piper to use as well that's but yeah I mean a deport will happen that's for sure it's just that when I say by the time sort of thing if if all the sudden there are tons of point three years ago let's say I want to fight go to fight us right now is really the reason that that is the reason for me to make party so far it always has been yep atmosphere is nice but I actually use a fighter - yeah I thanked him for 40 minutes this might people be on our website so if you want the core examples just go to my website or Twitter