title: How does timed JSON web signature serializer work?
body: <p>Can I restrict actions of my API to specific users if I generate a token like this:</p>
  
  <pre><code>from itsdangerous import TimedJSONWebSignatureSerializer as Serializer
  
  expiration = 600
  s = Serializer(current_app.config['SECRET_KEY'], expires_in = expiration)
  return s.dumps({ 'id': kwargs.get('user_id') })
  </code></pre>
  
  <p>And the verification</p>
  
  <pre><code>@staticmethod
      def verify_auth_token(token):
          s = Serializer(app.config['SECRET_KEY'])
          try:
              data = s.loads(token)
          except SignatureExpired:
              return None # valid token, but expired
          except BadSignature:
              return None # invalid token
          user = User.query.get(data['id'])
          return user
  </code></pre>
  
  <p>I don't understand how this works and achieves security. The way I'm used to securing an API for example, a user wants to do <strong>HTTP PUT</strong> to /posts/10 I'd usually get the post's author ie <strong>user_id</strong> then query the database get the token for that user_id, if the request token matches the queried token then it is safe for the <strong>PUT</strong>. I've read this <a href="http://blog.miguelgrinberg.com/post/restful-authentication-with-flask" rel="nofollow">article</a> and don't fully understand how it achieves security without storing anything in a database. Could someone explain how it works? </p>