How do you implement user authentication in Flask?

Summary

For session-based web apps use Flask-Login (user loader, login_user, logout_user, @login_required, current_user) with hashed passwords (Werkzeug's generate_password_hash or Argon2). For APIs use token-based auth (e.g., Flask-JWT-Extended).

Longer Answer

Flask-Login manages the session user ID and 'remember me' cookies; it doesn't handle registration, hashing or permissions. Regenerate the session on login, protect forms with CSRF tokens (Flask-WTF), and rate-limit login attempts.

Code Example

from flask_login import LoginManager, login_user, login_required, current_user
from werkzeug.security import check_password_hash

login_manager = LoginManager()

@login_manager.user_loader
def load_user(user_id: str):
    return db.session.get(User, int(user_id))

@bp.post("/login")
def login():
    user = db.session.scalar(db.select(User).filter_by(email=request.form["email"]))
    if user and check_password_hash(user.password_hash, request.form["password"]):
        login_user(user)
        return redirect(url_for("dashboard.index"))
    abort(401)

@bp.get("/me")
@login_required
def me():
    return {"email": current_user.email}

Key Points

• Flask-Login: session auth helpers
• @login_required decorator
• Hash passwords (scrypt/pbkdf2 via Werkzeug, or Argon2)
• Flask-JWT-Extended for APIs