Adding Request Trust to Flask Applications: A Practical Guide

Flask provides two clean integration points for pre-handler logic: the before_request hook, which runs before every request in a blueprint or application, and function decorators, which apply to individual routes.

For application-wide enforcement on all routes, before_request is appropriate. For surgical enforcement on specific routes — login, registration, password reset — a decorator keeps the intent explicit and the scope narrow.

A trust API needs IP address, HTTP method, path, and a safe subset of request headers. In Flask, request.remote_addr provides the immediate connection IP, but applications behind a proxy or load balancer need to read X-Forwarded-For with appropriate validation.

Headers to forward include User-Agent, Accept, Accept-Language, Referer, and Sec-Fetch-* headers. Avoid forwarding headers that contain credentials, session tokens, or application-specific data.

An ALLOW decision passes control to the decorated view function. A BLOCK decision returns a Flask Response with status 403. A CHALLENGE decision redirects to the challenge URL provided in the API response.

Network errors and timeouts should fail open — return None from the before_request hook or call the wrapped function directly. A trust API being temporarily unreachable should not take your login page offline.