在 Python API（接口）安全设计中，通常有四个关键要素需要考虑

from flask import Flask, jsonify, request
import jwt
import datetime

app = Flask(__name__)

# 设置密钥
app.config['SECRET_KEY'] = 'supersecretkey'

# 创建 JWT Token
@app.route('/login', methods=['POST'])
def login():
    # 假设使用用户名和密码认证
    auth_data = request.get_json()
    if auth_data and auth_data['username'] == 'admin' and auth_data['password'] == 'password':
        token = jwt.encode({
            'user': auth_data['username'],
            'exp': datetime.datetime.utcnow() + datetime.timedelta(minutes=30)  # 设置过期时间
        }, app.config['SECRET_KEY'])
        return jsonify({'token': token})
    
    return jsonify({'message': 'Invalid credentials'}), 401

# 保护的接口，需提供 JWT Token
@app.route('/protected', methods=['GET'])
def protected():
    token = request.headers.get('Authorization')
    if not token:
        return jsonify({'message': 'Token is missing!'}), 403

    try:
        # 验证 Token
        data = jwt.decode(token, app.config['SECRET_KEY'], algorithms=["HS256"])
        return jsonify({'message': 'Access granted', 'user': data['user']})
    except jwt.ExpiredSignatureError:
        return jsonify({'message': 'Token has expired!'}), 403
    except jwt.InvalidTokenError:
        return jsonify({'message': 'Invalid token!'}), 403

if __name__ == '__main__':
    app.run(debug=True)

from functools import wraps
from flask import jsonify

# 装饰器函数，用于检查用户角色
def role_required(role):
    def wrapper(f):
        @wraps(f)
        def decorated_function(*args, **kwargs):
            user_role = request.headers.get('Role')
            if user_role != role:
                return jsonify({'message': 'Access forbidden: insufficient privileges'}), 403
            return f(*args, **kwargs)
        return decorated_function
    return wrapper

# 仅管理员可以访问的资源
@app.route('/admin', methods=['GET'])
@role_required('admin')
def admin_only():
    return jsonify({'message': 'Welcome, admin!'})

import sqlite3

def safe_query(user_input):
    connection = sqlite3.connect('database.db')
    cursor = connection.cursor()
    
    # 使用参数化查询，避免 SQL 注入
    cursor.execute("SELECT * FROM users WHERE username = ?", (user_input,))
    rows = cursor.fetchall()

    connection.close()
    return rows

from flask import Flask

app = Flask(__name__)

@app.route('/')
def index():
    return 'Secure HTTPS connection!'

if __name__ == '__main__':
    # 启用 SSL 证书
    app.run(ssl_context=('cert.pem', 'key.pem'))