Flask and HTTPOnly Cookie - flask

Question

I am a bit confused on the use of the HTTPOnly cookie. When my user logs in it assigns the cookie and I see it in the response headers:
res = make_response({"status":"success","data":ret_rec})
res.set_cookie(key="PPS-Token",value=token,secure=True,httponly=True)
return res
In the response header:
Set-Cookie: PPS-Token=mylongtoken; Secure; HttpOnly; Path=/
Now I am unsure on how to validate the token once the user logs in:
def check_token(f):
#wraps(f)
def decorator(*args, **kwargs):
token = request.cookies.get("PPS-Token")
if not token:
build_response(status="error", message="Invalid Token...Contact Support")
...
How does the token persists when the user logs in? How do I verify the token on subsequent server requests>

Answer 1

The cookie cannot be accessed by the client when the HTTPOnly flag is set and it doesn't need to. It's usually set on the backends domain and will be send automatically by the web browser. So, whenever a request is being processed, you can execute some validation logic (i.e authentication or authorization). This is usually done in a decorator like that:
from functools import wraps
from flask import jsonify, current_app
def validate_something():
def wrapper(fn):
#wraps(fn)
def decorated_view(*args, **kwargs):
verify_token_somehow()
if not something:
return jsonify(msg="Permitted!"), 403
return current_app.ensure_sync(fn)(*args, **kwargs)
return decorated_view
return wrapper
Depending on how the cookie is set (session cookie or persistent cookie), it will be persistent until it gets invalid or until the session is closed.