Basically, make it so that each Raspberry Pi has its own login account/key. This could probably be done most effectively using the "Flask-Session" Python library (https://pythonhosted.org/Flask-Session/).
Also, HTTPS support should be added to the app, as this authentication-related communication should take place over an encrypted connection.
The way the app is coded right now, anyone with an internet connection can invoke the "setRoomStatus()" function in "flask_app.py" and add rooms that don't exist or interfere with the status of rooms that the Pi sensors are monitoring. A more serious implication of this is that it makes the site very vulnerable to cross-site scripting (basically, an attacker injecting malicious scripts into the HTML that gets sent to end-users).
Furthermore, to make development/debugging easier during the hackathon, HTTP "GET" requests were enabled; however, from a security perspective, this means that the "setRoomStatus()" function can be invoked from the URL address bar of Chrome, Firefox, or any other web-browser. The lines of code which allow for this should be commented out when not in use for development/debugging purposes.
Basically, make it so that each Raspberry Pi has its own login account/key. This could probably be done most effectively using the "Flask-Session" Python library (https://pythonhosted.org/Flask-Session/).
Also, HTTPS support should be added to the app, as this authentication-related communication should take place over an encrypted connection.
The way the app is coded right now, anyone with an internet connection can invoke the "setRoomStatus()" function in "flask_app.py" and add rooms that don't exist or interfere with the status of rooms that the Pi sensors are monitoring. A more serious implication of this is that it makes the site very vulnerable to cross-site scripting (basically, an attacker injecting malicious scripts into the HTML that gets sent to end-users).
Furthermore, to make development/debugging easier during the hackathon, HTTP "GET" requests were enabled; however, from a security perspective, this means that the "setRoomStatus()" function can be invoked from the URL address bar of Chrome, Firefox, or any other web-browser. The lines of code which allow for this should be commented out when not in use for development/debugging purposes.