{"id":27003052,"url":"https://github.com/riad-azz/flask-allowed-hosts","last_synced_at":"2025-10-10T20:39:52.016Z","repository":{"id":182341102,"uuid":"657935650","full_name":"riad-azz/flask-allowed-hosts","owner":"riad-azz","description":"Flask Allowed Hosts is a Flask extension that helps you limit access to your API endpoints.","archived":false,"fork":false,"pushed_at":"2024-10-10T03:56:34.000Z","size":54,"stargazers_count":2,"open_issues_count":1,"forks_count":1,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-09-08T11:02:12.327Z","etag":null,"topics":["allowedhosts","api","flask","flask-allowedhosts","flask-extensions","flask-security","host-validation","middleware","pypi-package","python","security","web-development"],"latest_commit_sha":null,"homepage":"https://pypi.org/project/flask-allowed-hosts/","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/riad-azz.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2023-06-24T09:01:54.000Z","updated_at":"2024-10-10T03:56:38.000Z","dependencies_parsed_at":null,"dependency_job_id":"3d8ceb82-5d59-46b9-8b06-b5e247467a9c","html_url":"https://github.com/riad-azz/flask-allowed-hosts","commit_stats":null,"previous_names":["riad-azz/flask-allowedhosts"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/riad-azz/flask-allowed-hosts","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/riad-azz%2Fflask-allowed-hosts","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/riad-azz%2Fflask-allowed-hosts/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/riad-azz%2Fflask-allowed-hosts/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/riad-azz%2Fflask-allowed-hosts/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/riad-azz","download_url":"https://codeload.github.com/riad-azz/flask-allowed-hosts/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/riad-azz%2Fflask-allowed-hosts/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":279005273,"owners_count":26083863,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-10T02:00:06.843Z","response_time":62,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["allowedhosts","api","flask","flask-allowedhosts","flask-extensions","flask-security","host-validation","middleware","pypi-package","python","security","web-development"],"created_at":"2025-04-04T05:15:08.986Z","updated_at":"2025-10-10T20:39:51.972Z","avatar_url":"https://github.com/riad-azz.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Flask Allowed Hosts\n\nThis extension provides a way to restrict access to your Flask application based on the incoming request's hostname or\nIP address or IP address range (network).\n\n## Features\n\n- Per-route configuration options.\n- Customize denied access behavior.\n- Two usage options: class-based or decorator-based.\n- Restrict access by hostname, IP address or IP address range (network).\n\n## Installation\n\nInstall the package using pip:\n\n```cmd\npip install flask-allowed-hosts\n```\n\n## Usage\n\n### Class-Based Usage\n\n1. Initialize the `AllowedHosts` class.\n2. Define allowed hosts (optional).\n3. Define a function for denied access behavior (optional).\n4. Apply access control to routes using `@allowed_hosts.limit()` decorator (optional).\n\n#### Example:\n\n```python\nfrom flask import Flask, jsonify, abort\nfrom flask_allowed_hosts import AllowedHosts\n\napp = Flask(__name__)\n\nALLOWED_HOSTS = [\"93.184.215.14\", \"api.example.com\"]\n\n\ndef custom_on_denied():\n    error = {\"error\": \"Oops! Looks like you are not allowed to access this page!\"}\n    return jsonify(error), 403\n\n\nallowed_hosts = AllowedHosts(app, allowed_hosts=ALLOWED_HOSTS, on_denied=custom_on_denied)\n\n\n# Allows all incoming requests\n@app.route(\"/api/public\", methods=[\"GET\"])\ndef public_endpoint():\n    data = {\"message\": \"This is public!\"}\n    return jsonify(data), 200\n\n\n# Only allows incoming requests from \"93.184.215.14\" and \"api.example.com\"\n@app.route(\"/api/private\", methods=[\"GET\"])\n@allowed_hosts.limit()\ndef private_endpoint():\n    data = {\"message\": \"This is private!\"}\n    return jsonify(data), 200\n\n\n# We can override the allowed_hosts list and the on_denied function for each route\n@app.route(\"/api/private/secret\", methods=[\"GET\"])\n@allowed_hosts.limit(allowed_hosts=[\"127.0.0.1\"], on_denied=lambda: abort(404))\ndef secret_private_endpoint():\n    data = {\"message\": \"This is very private!\"}\n    return jsonify(data), 200\n\n\nif __name__ == '__main__':\n    app.run(host='0.0.0.0', port=5000, debug=True)\n```\n\n### Decorator-Based Usage (Legacy)\n\n**Warning**: This approach might cause unexpected behavior when combined with the class-based usage.\n\n1. Define allowed hosts (optional).\n2. Define a function for denied access behavior (optional).\n3. Apply access control to routes using `@limit_hosts` decorator.\n\n#### Example:\n\n```python\nfrom flask import Flask, jsonify\nfrom flask_allowed_hosts import limit_hosts\n\napp = Flask(__name__)\n\nALLOWED_HOSTS = [\"93.184.215.14\", \"api.example.com\"]\n\n\ndef custom_on_denied():\n    error = {\"error\": \"Custom Denied Response\"}\n    return jsonify(error), 403\n\n\n# Allows all incoming requests\n@app.route(\"/api/public\", methods=[\"GET\"])\ndef public_endpoint():\n    data = {\"message\": \"This is public!\"}\n    return jsonify(data), 200\n\n\n# Only allows incoming requests from \"93.184.215.14\" and \"api.example.com\"\n@app.route(\"/api/private\", methods=[\"GET\"])\n@limit_hosts(allowed_hosts=ALLOWED_HOSTS, on_denied=custom_on_denied)\ndef private_endpoint():\n    return jsonify({\"message\": \"This is private!\"}), 200\n```\n\n### More Examples\n\nYou can find more examples in\nthe [examples directory](https://github.com/riad-azz/flask-allowed-hosts/tree/main/examples).\n\n## Configuration\n\n### Initialization Parameters\n\n- `app`: The Flask application instance (optional).\n- `allowed_hosts`: List of allowed hosts (optional, defaults to `None` which allows all hosts).\n- `on_denied`: Function for denied access behavior (optional).\n\n### Flask Config and Environment Variables\n\n#### Flask Configuration\n\nThe extension respects these configurations:\n\n- `ALLOWED_HOSTS`: List of allowed hosts in Flask config.\n- `ALLOWED_HOSTS_ON_DENIED`: Function for denied access behavior in Flask config.\n\n**Precedence**: Values provided during initialization override Flask config values.\n\n#### Environment Variables\n\nYou can enable debug mode by setting the `ALLOWED_HOSTS_DEBUG` environment variable to `True`:\n\n```shell\nexport ALLOWED_HOSTS_DEBUG=\"True\"\n```\n\nThis will print helpful debug messages to the console.\n\n## Contributing\n\nContributions are welcome! Please feel free to submit a Pull Request.\n\n## Support\n\nIf you have any questions or feedback, please feel free\nto [open an issue or a pull request](https://github.com/riad-azz/flask-allowed-hosts/issues).\n\n## License\n\nThis project is licensed under the [MIT] License - see the LICENSE.md file for details.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Friad-azz%2Fflask-allowed-hosts","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Friad-azz%2Fflask-allowed-hosts","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Friad-azz%2Fflask-allowed-hosts/lists"}