I would suggest using the flask-login extension, it makes session management really easy to add to your flask application, and provides a nice documentation which covers in details every aspect of the extension.
DigitalOcean
digitalocean.com › community › tutorials › how-to-add-authentication-to-your-app-with-flask-login
Add Authentication to Flask Apps with Flask-Login | DigitalOcean
October 22, 2025 - Learn how to add secure authentication to your Flask app using Flask-Login. Implement user sessions, login pages, and access control with Python.
Readthedocs
flask-login.readthedocs.io
Flask-Login 0.7.0 documentation
The function you set should take Flask request object and return a user object, or None if the user does not exist. ... A class or factory function that produces an anonymous user, which is used when no one is logged in. ... The name of the view to redirect to when the user needs to log in. (This can be an absolute URL as well, if your authentication machinery is external to your application.)
python - Flask user authentication - Stack Overflow
I have an application that will use flask and mongodb; I will probably host it on rackspace. I need to understand how flask authenticating works. I have not found much information on the subject. Is More on stackoverflow.com
Understanding Flask authentication, authorisation, session management
and continuation... (sorry) Is flask login session statefull? is it looking up corresponding session id with every request? So how does this work when I deploy flask with gunicorn? Won't every instance of flask have different session ids stored in memory? But I never had such issue More on reddit.com
6
13
May 19, 2022What is the best authentication system for production flask apps?
Can i see the result without voting myself? More on reddit.com
18
14
May 29, 2021[AF] Simple way to implement user authentication?
Since this is an educational project, I would recommend that you avoid the frameworks/libraries and do it by hand. It would be a good learning experience to see what actually happens under the hood. You have your users table that stores the hashed password. You have a token table that has a foreign key to the user table, and a token, and an expiration date. When the user logs in successfully, you insert a token (can be uuid) into the token table along with expiration date (e.g., datetime.now() + timedelta(hours=24)) . When the user logs out, delete the token. Each time the user accesses your application, he presents the token. You can query your token table to find the associated user and the expiration date. If the current date is greater than the expiration date, delete the token and 401 the user so he needs to log in again. If you are building an oldschool monolithic webpage, you can put the token in the session. If you are building a rest api, the front end that you build will take care of that More on reddit.com
12
6
July 28, 2022Videos
The Simplest Login System in Flask: HTTP Basic Auth
User Authentication - Flask Tutorial Series #8
29:35
Python Flask Authentication Tutorial - Learn Flask Login - YouTube
Python Blog Tutorial #2 - Flask User Authentication and Security
User Login with Flask_Login - Flask Fridays #22
01:07:49
Python Authentication: Create a Secure Login System with Flask ...
CodingNomads
codingnomads.com › python-flask-authentication-http-token-authentication
Flask Authentication for APIs: HTTP & Token Authentication
In this lesson you'll install Flask-HTTPAuth, and explore basic HTTP authentication and token authentication for your Python + Flask API users.
Auth0
developer.auth0.com › resources › guides › web-app › flask › basic-authentication
Flask Authentication By Example - Developer Center
August 30, 2023 - Python code that implements user login, logout and sign-up features to secure a Flask Web Application using Auth0.
GeeksforGeeks
geeksforgeeks.org › python › how-to-add-authentication-to-your-app-with-flask-login
How to Add Authentication to App with Flask-Login - GeeksforGeeks
July 23, 2025 - We can implement authentication, login/logout functionality in flask app using Flask-Login.
Top answer 1 of 3
69
I would suggest using the flask-login extension, it makes session management really easy to add to your flask application, and provides a nice documentation which covers in details every aspect of the extension.
2 of 3
17
I don't think that flask has any authentication built-in, only support for tracking sessions.
Here are some snippets for basic HTTP authentication and authentication with some third-party providers. Otherwise you will need to roll your own or use a framework that has this baked in (like Django)
Here is a discussion thread on this topic with a useful link
Readthedocs
flask-httpauth.readthedocs.io
Flask-HTTPAuth
Flask-HTTPAuth is a Flask extension that simplifies the use of HTTP authentication with Flask routes.
freeCodeCamp
freecodecamp.org › news › how-to-setup-user-authentication-in-flask
How to Set Up Basic User Authentication in a Flask App
January 3, 2023 - If not authenticated, we create an instance of the login form. If the request method is GET, we simply render a login.html file with the form. Otherwise, the form is validated. During the validation, we use the check_password_hash method from the Flask-Bcrypt library to match the hashed passwords.
Reddit
reddit.com › r/flask › understanding flask authentication, authorisation, session management
r/flask on Reddit: Understanding Flask authentication, authorisation, session management
May 19, 2022 -
What I do?
A User model, most important part of my application usually connected to dozens of other models.
User enters their unique username and password in a form on /register endpoint and submits.
The information submitted by user is recieved at backend.
I hash the password using bcrypt and save it in password_hash field.
For /login I match user password hash with the saved hash.
I use Flask-Login which is a "user session management" library according to documentation.
I add @login_required to routes I need user to be authenticated.
My burning questions
-
What is authentication part of this flow and what is authorisation part?
-
What is this "flow" called? Traditional...?
-
What is Flask-login doing exactly? What happens if I don't use it?
-
I am handling login/signup part almost manually, I'd like to do session part too, how does that work?
-
My "API endpoints" are where I recieve json data and return jsonify data and it works fine with the same setup. So why do "APIs need different way to auth/auth"? Is this because "browser is sending the cookie containing session info"?
-
What is the right way to do auth/auth in an application which will be accessed by browsers (both template rendered views and endpoints) & by raw api clients (say PostMan)
-
What is OAuth? 1/2?
-
Is OAuth only required when I need Google/Github/etc. login for my application? Or can it be used in "my flow"? Or should it be?
-
IdP (Identity Providers...?)
-
IAM (Identity Access Management?)
p.s. sry for this large post, u r not supposed to answer everything. any help appreciated, thanks
Top answer 1 of 3
2
and continuation... (sorry) Is flask login session statefull? is it looking up corresponding session id with every request? So how does this work when I deploy flask with gunicorn? Won't every instance of flask have different session ids stored in memory? But I never had such issue
2 of 3
2
For starters, many of things you asked are explained thoroughly in flask-login documentation, so check it out if you want to know more I do miss some theoretical knowledge but I will answer what I know What does flask-login do? What flask-login do is only handling session data, so it takes authenticator you give it (f.e. user id), store it as a cookie and authenticate it every time you enter page it does not handle verification of credentials or anything like this, you can (and should) use wtforms for it tho. You can do same flask-login does manually using plain cookies as well. How can I handle session manually? As I said it's possible using either flask-session which is a handler for a session cookie available everywhere in your code (in other modules than main as well), or creating session cookie manually with built-in cookie handlers, you need only to create decorator which will validate token in your session cookie. I wouldn't say it's needed though as there are additional security measurements in extensions, like CSRF tokens in wtforms Verification in APIs In terms of rest APIs as far as I'm concerned most common way is using JWT authorization bearer tokens inside request headers. Although it's impossible for browser user to use that, that's why we use cookies. You can read article on fastAPI wiki, it won't introduce you to flask implementation, but it's best I've read on the topic . There is also flaks one on a real python, it's okay, but I didn't like it personally . That's why we usually create different endpoints for rest APIs on websites, and I believe separating is the best way, I might be wrong though. Oauth Oauth is for authenticating with 3rd party APIs. As far as I'm concerned Oauth stands for token based authentication, it's basically flow like this: app tries to get personal data from 3rd party, user is presented with info on what data app tries to fetch, user makes decision on presenting app with data, app informs 3rd party about agreement, 3rd party presents app with authorization token. Surprisingly Wikipedia has quite good, full of technical info on topic if you want to know more. Others Thus is as much as I can tell you, I have no idea about those two last questions, but feel free to ask questions if you didn't get something
Descope
descope.com › blog › post › auth-flask-app
How to Add Authentication in Flask
June 26, 2025 - This step-by-step Flask authentication tutorial covers signup, login, logout, and profile features with secure session management.
Miguel Grinberg
blog.miguelgrinberg.com › post › the-flask-mega-tutorial-part-v-user-logins
The Flask Mega-Tutorial, Part V: User Logins - miguelgrinberg.com
December 3, 2023 - The value of this variable can be a user object from the database (which Flask-Login reads through the user loader callback I provided above), or a special anonymous user object if the user did not log in yet. Remember those properties that Flask-Login required in the user object? One of those was is_authenticated, which comes in handy to check if the user is logged in or not.
Microsoft Learn
learn.microsoft.com › en-us › entra › identity-platform › tutorial-web-app-python-flask-sign-in-out
Tutorial: Sign-in users to a Python Flask web app by using Microsoft identity platform - Microsoft identity platform | Microsoft Learn
December 1, 2025 - Add the required endpoints to your Flask app. The web app uses the authorization code flow to sign in the user. The ms_identity_python MSAL wrapper library helps with interacting with the MSAL library hence making it easier to add sign in and sign out to your app. We add an index page and protect it using the login_required decorator provided by the ms_identity_python library. The login_required decorator ensures that only authenticated users can access the index page.
Miguel Grinberg
blog.miguelgrinberg.com › post › restful-authentication-with-flask
RESTful Authentication with Flask - miguelgrinberg.com
November 27, 2013 - Note that this endpoint is protected with the auth.login_required decorator from Flask-HTTPAuth, which requires that username and password are provided. What remains is to decide how the client is to include this token in a request. The HTTP Basic Authentication protocol does not specifically require that usernames and passwords are used for authentication, these two fields in the HTTP header can be used to transport any kind of authentication information.
OneUptime
oneuptime.com › home › blog › how to implement flask-login for authentication
How to Implement Flask-Login for Authentication
February 3, 2026 - Before diving into code, here is the authentication flow: sequenceDiagram participant User participant Browser participant Flask participant FlaskLogin participant Database User->>Browser: Submit login form Browser->>Flask: POST /login (credentials) Flask->>Database: Verify credentials Database-->>Flask: User record Flask->>FlaskLogin: login_user(user) FlaskLogin->>Browser: Set session cookie Browser->>Flask: Request protected route Flask->>FlaskLogin: Load user from session FlaskLogin->>Database: user_loader callback Database-->>FlaskLogin: User object FlaskLogin-->>Flask: current_user Flask-->>Browser: Protected content
Medium
medium.com › @mathur.danduprolu › user-authentication-and-authorization-in-flask-building-secure-login-and-access-control-part-5-7-59679a08cdc3
User Authentication and Authorization in Flask: Building Secure Login and Access Control [Part 5/7] | by Mathur Danduprolu | Medium
November 13, 2024 - Flask-Login integrates seamlessly with Flask, handling session management and security tasks efficiently. To get started with user authentication, we need to install Flask-Login and Flask-WTF for form handling.
freeCodeCamp
freecodecamp.org › news › how-to-authenticate-users-in-flask
How to Authenticate Users in Flask with Flask-Login
November 1, 2021 - We import db, an instance of SQLAlchemy, and a UserMixin subclass from Flask-Login in the above code snippet. Our work is simplified by using the UserMixin, which allows us to use methods such as is_authenticated(), is_active(), is_anonymous(), and get_id ().
Hackers and Slackers
hackersandslackers.com › flask-login-user-authentication
Handle User Accounts & Authentication in Flask with Flask-Login
April 28, 2024 - is_anonymous: Many apps have a case where user accounts aren't entirely black-and-white, and anonymous users have access to interact without authenticating. This method might come in handy for allowing anonymous blog comments (which is madness, by the way). ... Creating a User model via UserMixin is by far the easiest way of getting started- the bulk of what remains is specifying the fields we want to capture for users. At a minimum, I'd suggest a username/email and password: """Database models.""" from . import db from flask_login import UserMixin from werkzeug.security import generate_passwo
DEV Community
dev.to › nagatodev › how-to-add-login-authentication-to-a-flask-and-react-application-23i7
How to add login authentication to a Flask and React application. - DEV Community
January 28, 2022 - In flask, adding authentication has been made quite easy with the @login_required decorator in the flask extension Flask-login.
Medium
medium.com › @choihalim › python-authenticating-and-authorizing-users-in-flask-applications-2db06fd2fcb5
Python: Authenticating and Authorizing Users in Flask Applications | by Halim Choi | Medium
June 29, 2023 - Instead of storing the user passwords in plaintext in the application’s database, we will be storing hashed passwords which will be compared to the user’s actual password during authentication. # app.py from flask import Flask, request, make_response, session import bcrypt # import configurations from config.py from config import app, db # importing the users table from database from models import User # route for sign up @app.route('/signup', methods=["POST"]) def signup(): if request.method == "POST": rq = request.get_json() username = rq['username'] password = rq['password'] # password
AskPython
askpython.com › home › flask user authentication – how to setup user login in flask?
Flask User Authentication - How to Setup User Login in Flask? - AskPython
July 7, 2022 - Now the only thing that is left is the login, register, and logout views. But before that, let us code a simple page that the users can see after authentication ... from flask import Flask, render_template from flask_login import login_required @app.route('/blogs') @login_required def blog(): return render_template('blog.html')