[Python]ちょうざつHS256(Flask, Requests, PyJWT)

$ pip install Flask requests PyJWT

import sys
from flask import Flask, abort, request
import jwt

secret_key = "secret"
if len(sys.argv) > 1:
    secret_key = sys.argv[1]
app = Flask(__name__)


def verify_token(token):
    try:
        payload = jwt.decode(token, secret_key, ["HS256"])
        return payload
    except:
        return


@app.route("/")
def hello_world():
    return "<p>Hello, World!</p>"


@app.route("/verify", methods=["POST"])
def verify():
    authorization_header = request.headers.get("Authorization")
    if not authorization_header or not authorization_header.startswith("Bearer "):
        abort(400)
    token = authorization_header[7:]
    payload = verify_token(token)
    if payload == None:
        abort(401)
    return payload


if __name__ == "__main__":
    app.run()

import sys
import jwt
from datetime import datetime, timedelta, timezone

secret_key = "secret"
if len(sys.argv) > 1:
    secret_key = sys.argv[1]
expiration_time = datetime.now(timezone.utc) + timedelta(hours=1)
token = jwt.encode({"exp": expiration_time}, secret_key, "HS256")
print(token)

import sys
import requests

token = "header.payload.signature"
if len(sys.argv) > 1:
    token = sys.argv[1]
headers = {"Authorization": f"Bearer {token}", "Content-Type": "application/json"}
res = requests.post("http://127.0.0.1:5000/verify", headers=headers)
print(res.status_code)
try:
    print(res.json())
except:
    print(res.text)

$ python app.py your_secret_key
$ python cli.py your_secret_key
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3MzY2MTEyMDB9.your_token_signature
$ python req.py eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3MzY2MTEyMDB9.your_token_signature
200
{'exp': 1736611200}