Make all routes private by default

[condemil]

I was looking into possible ways to make all routes private and only allow several routes public.

For now there are no straight-forward way to achieve that. I see two ways how that could be implemented:

1. Mark endpoints with @public decorator: it goes inline with existing @requires decorator + some configuration on the app (router?) level.
2. Mark routes as public by having PublicRoute class or by passing some argument to current Route class like Route("/", index, public=True).

The question is about maintaining backwards-compatibility. One solution could be to add configuration argument to the Starlette class.

Making routes private by default makes routing more prone to security mistakes when newly introduced routes may be quietly become public because @requires decorator is not added to the endpoint.

[alex-oleshkevich]

You can use Mount with middleware that checks user access to nested routes.

routes = [
  Route(), # public
  Mount(
    routes=[], # private routes here
    middleware=[], # add middleware here to check user access 
  ),
]

The idea here is a middleware that rejects unauthorized access to any child routes.

[condemil]

Probabliy I am missing something here, but what's the difference between this approach and global middleware?

[alex-oleshkevich]

You apply middleware to a subset of routes, not to all. Say, you can make protected (private) only /admin keeping all the rest public.
This solution is already available in Starlette, not sure if we need any other feature for that.

Or I may misunderstood your problem.

[condemil]

Thanks for the idea to use the middleware on Route/Mount, I was not aware of that possibility.

I ended up with the following approach:

• Subclass Route and add scopes argument with default value ["authenticated"], when I need public route I use it like Route(..., scopes["public"]).
• Subclassed Route always adds RouteMiddleware where scopes is checked.
• Scopes added by AuthenticationMiddleware earlier in the chain similar to the https://www.starlette.io/authentication/