Dash-auth is a Python library providing HTTP Basic Auth functionality for Dash applications. It enables developers to secure their Dash dashboards with simple username and password authentication. The current version is 2.3.0, and the package is actively maintained by Plotly, focusing on seamless integration within the Dash ecosystem.
pip install dash-authVerified import paths — ran on the pinned version, not inferred.
This quickstart demonstrates how to add HTTP Basic Authentication to a Dash application using `dash-auth`. It defines a set of valid username-password pairs (with one password loaded from an environment variable for security best practices), initializes `BasicAuth` with the Dash app, and protects the entire application. It also includes setting `app.server.secret_key` to avoid potential Flask session warnings.
For more advanced authentication (e.g., custom UI, user management, SSO, OAuth), consider `dash-enterprise-auth` (for Dash Enterprise users) or third-party solutions like `dash-auth-external` or `PropelAuth`.
Upgrade `dash-auth` to version 2.0.0 or later (e.g., `pip install dash-auth>=2.0.0`) when using Dash 2.0+ applications. `dash-auth` 2.0.0 removed `PlotlyAuth` entirely and updated dependencies for modern Dash versions.
Avoid using colons in passwords when supplying them as part of the `VALID_USERNAME_PASSWORD_PAIRS` dictionary or list. If you need to handle complex passwords, consider using an `auth_func` instead of a dictionary for validation.
Configure your health check to accept `401 Unauthorized` as a valid status, or implement a separate 'public' endpoint that bypasses authentication and returns `200 OK` for health checks.
Change the problematic password to remove the colon character. Alternatively, implement a custom `auth_func` for `BasicAuth` that handles password parsing more robustly, rather than relying on the default dictionary/list behavior.
Set a unique and strong `secret_key` for your Flask server: `app.server.secret_key = 'your_strong_random_secret_key'`. It is best practice to load this from an environment variable for production.
Check your deployment environment's proxy and server configurations. Ensure `WWW-Authenticate` headers are not being stripped or renamed. For AWS API Gateway, a custom authorizer might be needed as API Gateway can rename headers.