Skip to main content

A Flask extension which limits access to views.

Project description

Flask-Access CircleCI

Simple protection of Flask endpoints.

Integrates well with Flask-Login.

Protect endpoints

Here, the endpoint "/secret-code" requires a user to have "admin" rights:

def secret_code():
    return "1234"

You could have other requirements:

@flask_access.require("boss", 7, funny=True, bald=None)

Register a user loader

Flas-Access needs to associate the current request with a user that has permission or not. Flask-Access will look for the current user in app.config[flask_access.CURRENT_USER], here you can assign a function that returns the current user.

app.config[flask_access.CURRENT_USER] = my_current_user_func

The type of the returned user can be whatever you are using in your application to model users already, the only condition is that the user class implements a method has_access. If the user has no account return True to allow access. Anything other than True or an instance of a class implementing has_access will have access denied.

If you are also using Flask-Login you can simply apply the assignment below :clap:

app.config[flask_access.CURRENT_USER] = flask_login.current_user

User access logic

In short, implement has_access(self, rights) -> bool on your user class.

When a user attempts to access an endpoint, Flask-Access will load the current user object user and run user.has_access(rights), the rights that get passed in are the "boss", 7, funny=True, bald=None from above.

If a user doesn't have an has_access method, or the method doesn't return True, then access is denied :speak_no_evil:

Access denied handler

The default access denied handler calls flask.abort(403)

To set a custom access-denied handler:

app.config[flask_access.ABORT_FN] = my_custom_abort_func

Login required

If you are using flask_login.current_user as your user loader then flask_access.require implies flask_login.login_required, so no need to also specify the latter.

Why? Well, if a user is not logged-in, flask_login.current_user will return a flask_login.AnonymousUserMixin which does not have has_access implemented, hence no access for the user.


An example with a primitive login/out system.

Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for flask-access, version
Filename, size File type Python version Upload date Hashes
Filename, size flask_access- (4.8 kB) File type Wheel Python version py3 Upload date Hashes View
Filename, size flask-access- (3.4 kB) File type Source Python version None Upload date Hashes View

Supported by

AWS AWS Cloud computing Datadog Datadog Monitoring DigiCert DigiCert EV certificate Facebook / Instagram Facebook / Instagram PSF Sponsor Fastly Fastly CDN Google Google Object Storage and Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Salesforce Salesforce PSF Sponsor Sentry Sentry Error logging StatusPage StatusPage Status page