Flask-Security 5.7.0

Quickly add security features to your Flask application.

Quickly add security features to your Flask application.

Notes on this repo

As of 7/30/2024, the independent fork Flask-Security-Too replaced the archived Flask-Security repo (now called Flask-Security-3.0). This repo is published at PyPI at both Flask-Security and Flask-Security-Too. Please consider changing your requirements file to point to flask-security.

Flask-Security-Too was a fork from the 3.0.0 version of the Original

Pallets Community Ecosystem

This project is part of the Pallets Community Ecosystem. Pallets is the open source organization that maintains Flask; Pallets-Eco enables community maintenance of related projects. If you are interested in helping maintain this project, please reach out on the Pallets Discord server <https://discord.gg/pallets>.

Goals

• Use OWASP to guide best practice and default configurations.

• Be more opinionated and ‘batteries’ included by reducing reliance on abandoned projects and bundling in support for common use cases.

• Follow the Pallets lead on supported versions, documentation standards and any other guidelines for extensions that they come up with.

• Continue to add newer authentication/authorization standards:

  • ‘Social Auth’ integrated (using authlib) (5.1)

  • WebAuthn/Passkey support (5.0)

  • Two-Factor recovery codes (5.0)

  • First-class support for username as identity (4.1)

  • Support for freshness decorator to ensure sensitive operations have new authentication (4.0)

  • Support for email normalization and validation (4.0)

  • Unified signin (username, phone, passwordless) feature (3.4)

  • Two/Multi-Factor authentication supporting SMS, email, authenticator apps (4.0)

Contributing

Issues and pull requests are welcome. Other maintainers are also welcome. Please consult these contributing guidelines.

Installing

Install and update using pip:

pip install -U Flask-Security

Resources

• Documentation

• Releases

• Issue Tracker

• Code