Tutorial: Roll Your Own User Authorisation Management With Flask-Login
• Mitchell Busby
I'll quickly go through how I did user authentication and authorisation within Flask in this project, because it's annoying having to synthesise multiple best practices into one. There are other tools, like flask-bouncer, that do this for you, but I found them far too difficult to configure in my experience.
First, create your app i.e.
Decorate your user loader function, which should take a unique identifier, and return a class that extends flask_login.UserMixin. In this case I load a user from my regular user model class in SQLAlchemy, create a new object that extends from the flask_login class, and assign some values that I need to identify it by.
That's pretty much all there is to the actual configuration of flask_login. It supplies you with a current_user object, which is plugged into jinja2 so you can use it in your templates to render, for example, specific parts of a page depending on if your user is a customer or administrator.
flask-bouncer integrates well with flask-login to provide privileges to users and only allow certain users to access certain routes, but it's too heavy handed, so I used another one I found on the net:
This one works really nicely. All you have to do now is add protection to your routes!