Flask-Security Tutorial

4.11. Flask-Security Tutorial#

Implementing this manually is both time-consuming and risky. It is very easy to make mistakes that create vulnerabilities. To solve this, we can use existing and well tested software to implement security features for us.

In the case of flask, we can use the Flask-Security library which provides a suite of authentication and authorisation tools for us to use.

Flask-Security integrates with Flask-SQLAlchemy and other Flask extensions to provide a complete security solution.

4.11.1. Key Features of Flask-Security#

User authentication (login/logout)
User registration
Account locking and password recovery
Password hashing and salting for secure storage
Role and Permission management
Session and token-based authentication
Multi-factor authentication (MFA)

4.11.2. Documentation#

You can find the documentation here https://flask-security-too.readthedocs.io/en/stable/.

Demo: Flask-Security Basics

This Flask app demonstrates user authentication using Flask-Security. It sets up a user database, creates a test user, and restricts access to the home page so that only authenticated users can see it.

The page should only allow users to log in with the following credentials:

username: test@me.com password: password

../../_images/flask_security_basics_loop.gif

Setup

Database Setup

db = SQLAlchemy(app)            # Create database connection object
fsqla.FsModels.set_db_info(db)  # Define models

SQLAlchemy(app) initializes the database connection.
fsqla.FsModels.set_db_info(db) allows Flask-Security to automatically create the required user and role models.

Users and Roles

class Role(db.Model, fsqla.FsRoleMixin):
    pass

class User(db.Model, fsqla.FsUserMixin):
    pass

The User model represents registered users.
The Role model represents roles (e.g., admin, editor, user).
FsUserMixin and FsRoleMixin automatically add authentication fields like email, password, and active status.

user_datastore = SQLAlchemyUserDatastore(db, User, Role)
security = Security(app, user_datastore)

SQLAlchemyUserDatastore tells Flask-Security which database object to use and which classes to use for the users and roles.
Security(app, user_datastore) activates Flask-Security, enabling login, logout, and user management.

Creating a Test User

with app.app_context():
    db.create_all()
    if not security.datastore.find_user(email="test@me.com"):
        security.datastore.create_user(
            username="Test User",
            email="test@me.com",
            password=hash_password("password"),
        )
    db.session.commit()

db.create_all() creates the user and role tables in the database.
security.datastore.find_user(email="test@me.com") checks if the test user already exists.
security.datastore.create_user(...) creates a new user (test@me.com) with the password "password".
hash_password("password") hashes the password before storing it.

Note

The password generated by hash_password is salted by default. The salt is stored in the password field by appending it to the hashed password, eliminating the need for a salt field in the database.

Authentication and Authorisation

Flask-Security comes with routes and templates built in for user login. You don’t need to write these yourself, however you can customise the templates if you like.

The @auth_required() decorator on a route will:

check if the user is logged in or not
if user is logged in the route function will run as normal
if user is not logged in then:
- the user will be redirected to the login page at /login
- after the user successfully logs in they will be redirected to the originally requested page

@app.route("/")
@auth_required()
def home():
    return render_template_string("Hello {{ current_user.username }} ({{ current_user.email }})")

This index (homepage) route function is protected by @auth_required().

app.py#

import os
from flask import Flask, render_template_string
from flask_sqlalchemy import SQLAlchemy
from flask_security import Security, SQLAlchemyUserDatastore, auth_required, hash_password
from flask_security.models import fsqla_v3 as fsqla

# Create app and set configuration parameters
app = Flask(__name__)
app.config["DEBUG"] = True
app.config["SECRET_KEY"] = "secretkey"
app.config["SECURITY_PASSWORD_SALT"] = "146585145368132386173505678016728509634"
app.config["SQLALCHEMY_DATABASE_URI"] = "sqlite:///database.db"

# Database setup
db = SQLAlchemy(app)  # Create database connection object
fsqla.FsModels.set_db_info(db)  # Define models

class Role(db.Model, fsqla.FsRoleMixin):
    pass

class User(db.Model, fsqla.FsUserMixin):
    pass

# Setup Flask-Security
user_datastore = SQLAlchemyUserDatastore(db, User, Role)
security = Security(app, user_datastore)

# Create test user
with app.app_context():
    # Create User to test with
    db.create_all()
    if not security.datastore.find_user(email="test@me.com"):
        security.datastore.create_user(
            username="Test User",
            email="test@me.com",
            password=hash_password("password"),
        )
    db.session.commit()

# Views
@app.route("/")
@auth_required()
def home():
    return render_template_string("Hello {{ current_user.username }} ({{ current_user.email }})")

app.run(debug=True, reloader_type="stat", port=5000)

Flask-Security Tutorial

Contents

4.11. Flask-Security Tutorial#

4.11.1. Key Features of Flask-Security#

4.11.2. Documentation#