Flask-Security is now deprecated, so I wouldn't recommend using it in production. There is a fork of it called Flask Security Too but it doesn't seem very widely followed.

To be honest even when it was maintained it wasn't my favourite as I think it tried to do too much.

Flask-Login on the other hand is a solid library. It is very "flasky" in the sense that it is low level and deals with the really annoying stuff (creating a session, persisting it with cookies, delivering a current_user, putting certain routes behind a login_required decorator) and then letting you design your own flow and pull in the libraries you want.

For instance if you want social login or OAuth token storage then Flask-Dance, which integrates nicely with Flask-Login and is actively maintained, smashes Flask-Social which integrates with Flask-Security.

There is also Flask-User, which gets good reviews but last commit was in 2019, which is a little scary.

No, this wouldn't be considered secure. Just implement proper authentication and authorization instead. If you really still want the view to be random, just generate it randomly, but using proper authentication and authorization is still required to be 'secure'

The flask-login extension implements a lot of the boilerplate for this for you, making it a lot simpler with a lot more functionality.

Some other notes:

• You probably don't want to use hash which is (1) not consistent, meaning users passwords change every reload and (2) is not secure in terms of cryptography.
• You probably should store salted and hashed passwords, for example, using bcrypt or otherwise use a strong hashing algorithm.

Here, I'll provide an example using the standard lib hashlib.pbkdf2_hmac. You can also consider other strong password hashing algorithms like hashlib.scrypt. But be aware, we're still taking some shortcuts here.

For example, generate the salted and hashed password:

import hashlib
import secrets


username = salt = b'user1'
# generating and storing a random salt for each user would be more secure, too.
# salt = secrets.token_bytes(32)  # store this value somewhere

# generate a random password
# password = bytes(secrets.token_urlsafe(32), 'ascii')
password = b'pw1'  # static for this example
print(username, 'keep this safe:', str(password, 'ascii'))

salted_hashed = hashlib.pbkdf2_hmac('sha256', password, salt, iterations=500_000)
print('here is the hash', salted_hashed.hex())

This will produce an output like:

admin keep this safe: pw1
here is the hash aeca87e94befc6006398c776707e39cf79530500b273c3789661dbfcf2e86ffa

Then your app can store the salted & hashed password. Usually, this happens in a database, but for simplicity, we'll keep your dictionary approach.

Putting that all together, your app may look like this (without using flask-login):

import functools
import hashlib
from flask import session, Flask, request, flash, render_template, redirect, url_for
app = Flask(__name__)


USERS = {
    "user1": ['aeca87e94befc6006398c776707e39cf79530500b273c3789661dbfcf2e86ffa', "page_admin"],
    # ...
}

app.secret_key = b'super-secret'

def login_required(allowed_users='all'):
    def wrapper(view):
        @functools.wraps(view)
        def wrapped_view(*args, **kwargs):
            logged_in_user = session.get('user')
            if logged_in_user is None:
                print('authentication required')
                flash('authentication required')
                return redirect(url_for('page_login'))
            if allowed_users != 'all':
                if logged_in_user not in allowed_users:
                    return 'Not authorized', 403
                else:
                    return view(*args, **kwargs)
            else:  # if allowed_users not specified, any logged in user is OK
                return view(*args, **kwargs)
        return wrapped_view
    return wrapper


@app.route('/login', methods=['POST', 'GET'])
def page_login():
    if request.method == "POST":
        login = request.form["login"]
        if login in USERS:
            salt = bytes(login, 'ascii')
            pw = bytes(request.form['password'], 'ascii')
            password = hashlib.pbkdf2_hmac('sha256', pw, salt, iterations=500_000).hex()
            if password == USERS[login][0]:
                print('Successfully logged in')
                flash('successfully logged in')
                session['user'] = login
                landing_page = USERS[login][1]
                return redirect(url_for(landing_page))
            else:
                print('bad password')
                flash('bad login')
        else:
            print('unknown user')
            flash('bad login')
    return render_template("page_login.html")


@app.route('/lab/user')
@login_required()
def page_user():
    username = session.get('user')
    return f'Hello {username} (user)'

@app.route('/lab/admin')
@login_required(allowed_users=('user1',))
def page_admin():
    username = session.get('user')
    return f'Hello {username} (admin)'

the login process seems secure.

But you didn't check the potential existing user in the signup form, or existing email address. Unless this is managed by the underlying User schema.

And you should require a minimal password complexity. Danjgo does this by default but the passwordmeter package could help you to achieve this.

https://pypi.python.org/pypi/passwordmeter

I think Flask-Security is deprecated right now. I never used Flask-User on a project. Flask-Login was always my choice for handling sessions/users. You can make your own session handler. I recommend using JWT for authentication & authorization.