# Handler Auth Flow

> Add or modify Tornado handlers safely with auth, route ordering, and shared state conventions

- Skill: `fossasia/handler-auth-flow` (Agent Skill)
- Install (CLI): `npx skillmds@latest add fossasia/handler-auth-flow`
- Raw SKILL.md: https://api.skillmd.com/api/skills/fossasia/handler-auth-flow/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: fossasia (https://skillmd.com/u/fossasia)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/fossasia/handler-auth-flow

---


# Skill: Handler and Auth Flow

## When to Use

Use this skill when changing `py/visdom/server/handlers/` or server routes.

## Core Workflow

1. Implement or modify handler classes in `web_handlers.py` or `socket_handlers.py`.
2. Keep `@check_auth` on protected handler methods.
3. In handler `initialize()`, copy required app attributes (do not refactor to `self.app`).
4. Register routes in `py/visdom/server/app.py` before fallback/index catch-alls.
5. Ensure both WebSocket and polling flows behave consistently.
6. Confirm browser-facing commands and payload keys remain stable.

## Guardrails

- Missing `@check_auth` is an auth bypass.
- Keep environment access sanitized and scoped to `env_path`.
- Avoid silent failure paths in handlers.

## Documentation

- [Skill reference](references/REFERENCE.md)
- `py/visdom/server/app.py`
- `py/visdom/server/handlers/web_handlers.py`
- `py/visdom/server/handlers/socket_handlers.py`
- `py/visdom/server/handlers/base_handlers.py`
- `AGENTS.md`
- `CONTRIBUTING.md`

## Assets

- See `assets/README.md` and store templates/resources in `assets/`.

## Tests

- Follow the default flow in `references/TESTS.md`.