WAI Forward Developer Blog

How to Develop a Secure Login System with Flask and Python

By: WAI Forward ltd on March 24, 2025

Creating a secure login system is essential for protecting user data in web applications. Flask, a lightweight Python web framework, allows developers to build authentication systems efficiently while maintaining security best practices.

In this guide, we’ll walk through the process of developing a secure login system using Flask, hashing passwords, and implementing user authentication.

Why Use Flask for User Authentication?

Flask provides several benefits for building a secure login system:

Lightweight and Flexible: Allows for easy customization.
Security Features: Supports password hashing, session management, and authentication.
Integration with Databases: Works well with SQLite, PostgreSQL, and MySQL.

Prerequisites

Before getting started, install the required libraries:

pip install flask flask-sqlalchemy flask-login werkzeug

Step 1: Set Up the Flask Project

Create a project folder and a new Python file:

mkdir flask_login_system
cd flask_login_system
touch app.py

Step 2: Configure Flask and Database

Initialize Flask and configure SQLite as the database.

from flask import Flask, render_template, redirect, url_for, request, flash
from flask_sqlalchemy import SQLAlchemy
from flask_login import LoginManager, UserMixin, login_user, login_required, logout_user

app = Flask(__name__)
app.config['SECRET_KEY'] = 'your_secret_key'
app.config['SQLALCHEMY_DATABASE_URI'] = 'sqlite:///users.db'
db = SQLAlchemy(app)
login_manager = LoginManager(app)
login_manager.login_view = "login"

Step 3: Create the User Model

Define a user model with password hashing.

from werkzeug.security import generate_password_hash, check_password_hash

class User(UserMixin, db.Model):
    id = db.Column(db.Integer, primary_key=True)
    username = db.Column(db.String(150), unique=True, nullable=False)
    password = db.Column(db.String(150), nullable=False)

@login_manager.user_loader
def load_user(user_id):
    return User.query.get(int(user_id))

Step 4: Create the Registration Route

Allow users to register with a hashed password.

@app.route('/register', methods=['GET', 'POST'])
def register():
    if request.method == 'POST':
        username = request.form['username']
        password = request.form['password']
        hashed_password = generate_password_hash(password, method='sha256')
        new_user = User(username=username, password=hashed_password)
        db.session.add(new_user)
        db.session.commit()
        flash('Registration successful!')
        return redirect(url_for('login'))
    return render_template('register.html')

Step 5: Create the Login Route

Authenticate users and manage sessions.

@app.route('/login', methods=['GET', 'POST'])
def login():
    if request.method == 'POST':
        username = request.form['username']
        password = request.form['password']
        user = User.query.filter_by(username=username).first()

        if user and check_password_hash(user.password, password):
            login_user(user)
            return redirect(url_for('dashboard'))
        else:
            flash('Invalid username or password')

    return render_template('login.html')

Step 6: Create a Protected Dashboard

Ensure only logged-in users can access the dashboard.

@app.route('/dashboard')
@login_required
def dashboard():
    return "Welcome to your dashboard!"

Step 7: Create the Logout Route

Allow users to log out securely.

@app.route('/logout')
@login_required
def logout():
    logout_user()
    flash('You have been logged out.')
    return redirect(url_for('login'))

Step 8: Running the Flask Application

Initialize the database and run the app:

if __name__ == '__main__':
    db.create_all()
    app.run(debug=True)

Best Practices for Secure Authentication

Use Password Hashing: Never store plain-text passwords.
Implement Session Management: Use Flask-Login to handle authentication sessions.
Enable HTTPS: Encrypt data transmission using SSL certificates.
Limit Login Attempts: Prevent brute-force attacks.
Use Environment Variables: Store secret keys securely.

FAQs

Can I use PostgreSQL instead of SQLite? Yes, update the database URI to PostgreSQL.
How do I add email verification? Use Flask-Mail to send verification emails.
Is Flask secure for production? Yes, when configured with proper security practices.
How can I add OAuth login? Use Flask-OAuthLib for Google, Facebook, or GitHub login.
Can I deploy this login system? Yes, use Gunicorn with a web server like Nginx.

Conclusion

Developing a secure login system in Flask ensures user authentication is handled efficiently and safely. By implementing password hashing and session management, you can create a reliable authentication system for your applications.

Start building your Flask login system today and enhance security in your web applications!

Back to Blog