Skip to main content

An authorization middleware for Flask that supports ACL, RBAC, ABAC, based on Casbin

Project description


GitHub Action Coverage Status Version PyPI - Wheel Pyversions Download Discord

flask-authz is an authorization middleware for Flask, it's based on PyCasbin.


pip install flask-authz

Or clone the repo:

$ git clone
$ python install

Module Usage:

from flask import Flask
from flask_authz import CasbinEnforcer
from casbin.persist.adapters import FileAdapter

app = Flask(__name__)
# Set up Casbin model config
app.config['CASBIN_MODEL'] = 'casbinmodel.conf'
# Set headers where owner for enforcement policy should be located
app.config['CASBIN_OWNER_HEADERS'] = {'X-User', 'X-Group'}
# Add User Audit Logging with user name associated to log
# i.e. `[2020-11-10 12:55:06,060] ERROR in casbin_enforcer: Unauthorized attempt: method: GET resource: /api/v1/item by user:`
app.config['CASBIN_USER_NAME_HEADERS'] = {'X-User'}
# Set up Casbin Adapter
adapter = FileAdapter('rbac_policy.csv')
casbin_enforcer = CasbinEnforcer(app, adapter)

@app.route('/', methods=['GET'])
def get_root():
    return jsonify({'message': 'If you see this you have access'})

@app.route('/manager', methods=['POST'])
def make_casbin_change(manager):
    # Manager is an casbin.enforcer.Enforcer object to make changes to Casbin
    return jsonify({'message': 'If you see this you have access'})

Example Config This example file can be found in tests/casbin_files

r = sub, obj, act

p = sub, obj, act

g = _, _

e = some(where (p.eft == allow))

m = (p.sub == "*" || g(r.sub, p.sub)) && r.obj == p.obj && (p.act == "*" || r.act == p.act)

Example Policy This example file can be found in tests/casbin_files

p, alice, /dataset1/*, GET
p, alice, /dataset1/resource1, POST
p, bob, /dataset2/resource1, *
p, bob, /dataset2/resource2, GET
p, bob, /dataset2/folder1/*, POST
p, dataset1_admin, /dataset1/*, *
p, *, /login, *

p, anonymous, /, GET

g, cathy, dataset1_admin


Run unit tests

  1. Fork/Clone repository
  2. Install flask-authz dependencies, and run pytest
pip install -r dev_requirements.txt
pip install -r requirements.txt

Setup pre-commit checks

pre-commit install

update requirements with pip-tools

# update requirements.txt
pip-compile --no-annotate --no-header --rebuild
# sync venv

Manually Bump Version

bumpversion major  # major release
bumpversion minor  # minor release
bumpversion patch  # hotfix release


The authorization determines a request based on {subject, object, action}, which means what subject can perform what action on what object. In this plugin, the meanings are:

  1. subject: the logged-in user name
  2. object: the URL path for the web resource like "dataset1/item1"
  3. action: HTTP method like GET, POST, PUT, DELETE, or the high-level actions you defined like "read-file", "write-blog"

For how to write authorization policy and other details, please refer to the Casbin's documentation.

Getting Help


This project is under Apache 2.0 License. See the LICENSE file for the full license text.

Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

flask-authz-2.6.0.tar.gz (13.7 kB view hashes)

Uploaded Source

Built Distribution

flask_authz-2.6.0-py2.py3-none-any.whl (12.9 kB view hashes)

Uploaded Python 2 Python 3

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page