User Authentication and Protected Routes

1. Secure User Registration

Our first step is to take the data from the registration form, securely hash the password, and save the new user to our database. We'll also ensure that each user has a unique username and email.

Password Hashing and Saving Users

In the last lesson, we discussed using slow, salted hash functions. The Flask-Bcrypt extension provides a convenient way to use the robust bcrypt algorithm within Flask.

The following video from Corey Schafer's excellent Flask series will walk you through installing Flask-Bcrypt, initializing it, and using it in your registration route to securely handle passwords. It also demonstrates how to add custom validators to your form to prevent duplicate usernames and emails, which is a much more user-friendly approach than letting the database raise an error.

To summarize the key steps for registration:

1. Install and Initialize:

   pip install flask-bcrypt
   

   In your app's __init__.py:

   from flask_bcrypt import Bcrypt
   bcrypt = Bcrypt(app)
   

2. Hash Password in Route: In your register route, after the form validates:

   hashed_password = bcrypt.generate_password_hash(form.password.data).decode('utf-8')
   user = User(username=form.username.data, email=form.email.data, password=hashed_password)
   db.session.add(user)
   db.session.commit()
   

3. Add Custom Validators: In your forms.py, inside the RegistrationForm class:

   from .models import User
   from wtforms.validators import ValidationError
   
   def validate_username(self, username):
       user = User.query.filter_by(username=username.data).first()
       if user:
           raise ValidationError('That username is taken. Please choose a different one.')
           
   def validate_email(self, email):
       user = User.query.filter_by(email=email.data).first()
       if user:
           raise ValidationError('That email is taken. Please choose a different one.')
   

2. Managing User Sessions with Flask-Login

Now that users can register, we need a way to manage their sessions when they log in. This is where Flask-Login comes in. It handles all the background work of session management, such as creating session cookies and providing access to the currently logged-in user.

The setup involves three crucial steps:

1. Initializing the LoginManager.
2. Preparing your User model to work with Flask-Login.
3. Creating a user_loader function.

Let's continue with the same video to see how this is done.

The user_loader function is the bridge between Flask-Login's session management and your user database. When a request comes in, Flask-Login reads the user ID from the session cookie and then calls your user_loader function with that ID to retrieve the actual user object. This object is then made available as current_user.

This diagram illustrates the flow after a user has logged in.

3. Implementing Login and Logout

With Flask-Login configured, we can now implement the core login and logout functionality.

Login

The login process involves:

1. Finding the user in the database by their email or username.
2. Verifying their password using bcrypt.check_password_hash().
3. If credentials are valid, calling login_user() to create the session.

Logout

The logout process is even simpler: just call the logout_user() function to clear the session.

Conditional Navigation

A good user experience requires showing relevant navigation links. Logged-in users should see "Account" and "Logout," while anonymous users should see "Login" and "Register." This is easily achieved in your Jinja2 templates using current_user.is_authenticated.

Let's see this all in action.

4. Protected Routes and Final Touches

The primary purpose of authentication is to restrict access to certain parts of your application. Flask-Login makes this incredibly simple with the @login_required decorator.

We also want to improve the user experience by redirecting users back to the page they were trying to access before they were prompted to log in.

To make a route require authentication, you do two things:

1. Tell Flask-Login where your login page is in your __init__.py:

   login_manager.login_view = 'auth.login' # 'auth.login' is the endpoint name
   

2. Add the decorator to any route you want to protect:

   from flask_login import login_required
   
   @app.route('/account')
   @login_required
   def account():
   
   
   
       # This code will only run if the user is logged in
       return render_template('account.html')
   

This flowchart provides a high-level overview of the complete authentication system you've just built.

Conclusion

Congratulations! You have now implemented a complete and secure user authentication system in Flask. This is a major milestone and a foundational component of almost every web application you will build.

Key Takeaways:

• Registration: Use Flask-Bcrypt's generate_password_hash() to securely store passwords and implement custom form validators to check for unique user details.
• Flask-Login Setup: Configure Flask-Login by initializing LoginManager, adding UserMixin to your User model, and creating a @login_manager.user_loader callback.
• Login/Logout: Use login_user() to create a session and logout_user() to destroy it.
• Access Control: Use the @login_required decorator to protect routes and current_user.is_authenticated in templates to control what the user sees.
• User Experience: Improve flow by redirecting users to their intended page after login using the next parameter.

In our next lesson, we'll shift gears to another core component of modern web development: building RESTful APIs. You'll learn the principles behind APIs and how to build your first endpoints using Flask, which will eventually allow your AI models to communicate with other services and front-end applications.