title: Setting Authorization header - Flask app using Python Requests and JWT
body: <p>I am just learning to code and this has been driving me crazy. I don't know if I am missing something very simple or have a total misunderstanding about how authentication works (very possibly both), however, i would appreciate someone help.</p>
  <p>I have created a login route for my flask app which renders the following and successfully allows a user logging in.</p>
  <p><a href="https://i.stack.imgur.com/rxVHl.png" rel="nofollow noreferrer">Login Page</a></p>
  <p>If a user successfully logs in, i want to set the Authorization header using a token generated using JWT. I am using the request libary to do this and get a 200 response but everytime i check the network tab, i can not see the token in the 'Authorization' Response Header.</p>
  <p>The idea is that once this Header has been set, i can protect my apis by ensuring a token is present and also use that information to ensure that APIs only return data for that user i.e. decrypt the token to work out the user.</p>
  <p><a href="https://i.stack.imgur.com/DFfpv.png" rel="nofollow noreferrer">Network tab - No Authorization Header</a></p>
  <p>This is my current code. Where am i going wrong? Does my approach sound correct?</p>
  <pre><code>@loginsBlueprint.route('/login', methods=['GET', 'POST'])
  def login():
      error = None
      if request.method == 'POST':
          user = User.query.filter_by(username=request.form['username']).first()
          if user is not None and bcrypt.check_password_hash(user.password, request.form['password']):
              token = jwt.encode(
                  {'user': request.form['username'], 'exp': datetime.datetime.utcnow() + datetime.timedelta(seconds=15)},
                  app.config['SECRET_KEY'])
  
              url = 'http://127.0.0.1:5000/login'
              headers = {'Authorization': 'Bearer ' + token}
              requests.get(url, headers=headers)
  
              return render_template('landing_page.html')
          else:
              return make_response('Could not verify', 403,
                                   {'WWW-Authenticate': 'Basic realm =&quot;Wrong Password !!&quot;'})
      return render_template('login.html', error=error)
  </code></pre>
  <p>login.html</p>
  <pre><code>&lt;html&gt;
    &lt;head&gt;
      &lt;title&gt;Flask Intro - login page&lt;/title&gt;
      &lt;meta name=&quot;viewport&quot; content=&quot;width=device-width, initial-scale=1.0&quot;&gt;
      &lt;link href=&quot;static/bootstrap.min.css&quot; rel=&quot;stylesheet&quot; media=&quot;screen&quot;&gt;
    &lt;/head&gt;
    &lt;body&gt;
      &lt;div class=&quot;container&quot;&gt;
        &lt;h1&gt;Please login&lt;/h1&gt;
        &lt;br&gt;
        &lt;form action=&quot;&quot; method=&quot;post&quot;&gt;
          &lt;input type=&quot;text&quot; placeholder=&quot;Username&quot; name=&quot;username&quot; value=&quot;{{
            request.form.username }}&quot;&gt;
           &lt;input type=&quot;password&quot; placeholder=&quot;Password&quot; name=&quot;password&quot; value=&quot;{{
            request.form.password }}&quot;&gt;
          &lt;input class=&quot;btn btn-default&quot; type=&quot;submit&quot; value=&quot;Login&quot;&gt;
        &lt;/form&gt;
        {% if error %}
          &lt;p class=&quot;error&quot;&gt;&lt;strong&gt;Error:&lt;/strong&gt; {{ error }}
        {% endif %}
      &lt;/div&gt;
    &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  <p>Note: I have tried changing to <code>requests.post</code> but get a 400:</p>
  <pre><code>127.0.0.1 - - [30/Mar/2021 21:53:29] &quot;←[31m←[1mPOST /login HTTP/1.1←[0m&quot; 400 
  </code></pre>
  <p>I thought it might be because i'm using CORS and so added this in:</p>
  <pre><code>CORS(app, expose_headers='Authorization')
  </code></pre>