Registry / web-framework / flask-basicauth

flask-basicauth

library0.2.0pypypi✓ verified 23d ago

Flask-BasicAuth is a Flask extension that provides a straightforward way to add HTTP basic access authentication to specific views or an entire Flask application. The current version is 0.2.0, released in June 2013, indicating a very slow release cadence and a largely unmaintained status.

web-framework auth-security

pip install Flask-BasicAuth

github ↗package ↗

INSTALL

IMPORT

SIG · FLASK-BASICAUTH

flask-basicauth

web-frameworkpythonv0.2.0

Install

3.1s avg

Import

466ms

Disk

22MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v0.2.0 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.482s · 23.9MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 3.1s · import 0.450s · 24MB

22MB installed

● package 22MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

BasicAuth

✓ from flask_basicauth import BasicAuth

This quickstart initializes a Flask application with Flask-BasicAuth. It demonstrates protecting a single route (`/secret`) using the `@basic_auth.required` decorator. Credentials are loaded from environment variables for security, defaulting to 'admin' and 'secret'. The example also notes how to protect the entire application using `BASIC_AUTH_FORCE = True`.

import os from flask import Flask, render_template_string from flask_basicauth import BasicAuth app = Flask(__name__) app.config['BASIC_AUTH_USERNAME'] = os.environ.get('BASIC_AUTH_USERNAME', 'admin') app.config['BASIC_AUTH_PASSWORD'] = os.environ.get('BASIC_AUTH_PASSWORD', 'secret') basic_auth = BasicAuth(app) @app.route('/') def index(): return "Welcome!" @app.route('/secret') @basic_auth.required def secret_view(): return render_template_string("<h1>Secret Page</h1><p>Accessed with basic auth.</p>") if __name__ == '__main__': # To protect the entire site (e.g., for staging environments): # app.config['BASIC_AUTH_FORCE'] = True # Ensure BASIC_AUTH_USERNAME and BASIC_AUTH_PASSWORD are set as environment variables # or directly in app.config for production. app.run(debug=True)

Debug

Known issues

breakingBasic Authentication sends credentials (username and password) in cleartext over the network, only Base64 encoded, which is easily reversible. It is CRITICAL to use HTTPS/TLS to encrypt the connection between the client and server. Without HTTPS, credentials can be easily intercepted.

fix

Always deploy Flask applications using Flask-BasicAuth behind an HTTPS/TLS-enabled server (e.g., Nginx, Apache) in production environments.

affects: 0.1.0 - 0.2.0

gotchaWhen deploying Flask-BasicAuth behind a reverse proxy like Nginx or Apache with mod_wsgi, the proxy might strip the `Authorization` header, preventing Flask-BasicAuth from receiving the credentials.

fix

Configure your reverse proxy to pass the `Authorization` header to the backend. For Apache/mod_wsgi, add `WSGIPassAuthorization On` to your configuration. For Nginx, ensure `proxy_set_header Authorization $http_authorization;` is set.

affects: 0.1.0 - 0.2.0

gotchaThe `BASIC_AUTH_FORCE = True` configuration, intended to protect the entire application, has been reported to cause continuous re-prompting for credentials in some browsers due to how authorization headers are handled.

fix

If experiencing issues with `BASIC_AUTH_FORCE`, consider explicitly decorating each protected view with `@basic_auth.required` or explore alternative Flask authentication extensions like `Flask-HTTPAuth`.

affects: 0.1.0 - 0.2.0

gotchaFlask-BasicAuth performs a direct string comparison for usernames and passwords (cleartext comparison). It does not include mechanisms for secure password hashing (e.g., bcrypt, scrypt) or storage.

fix

For production applications requiring secure user management and password storage, consider using more robust Flask extensions like `Flask-Login` combined with `Flask-Bcrypt`, or `Flask-HTTPAuth` which supports secure password hashing. Flask-BasicAuth is best suited for simple, low-security scenarios or protecting staging environments.

affects: 0.1.0 - 0.2.0

deprecatedThis library has not been updated since June 2013, with Python 3 support only officially extending to Python 3.3. It is largely unmaintained, and may not be compatible with newer Flask versions or Python releases, or may lack features and security updates present in more active alternatives.

fix

For new projects or applications requiring ongoing maintenance and modern features, consider using actively developed alternatives such as `Flask-HTTPAuth` (for various HTTP auth schemes including Basic with hashed passwords) or `Flask-Login` (for session-based user management).

affects: All versions

Errors

Common errors & fixes

ModuleNotFoundError: No module named 'flask_basicauth'

The 'flask_basicauth' package is not installed in the Python environment, or the Python interpreter cannot find it.

fix

Install the package using pip: `pip install Flask-BasicAuth`

ImportError: No module named flask.ext.basicauth

This error occurs because 'flask.ext.*' imports were deprecated in Flask 0.9 and removed in Flask 1.0. Modern Flask extensions should be imported directly.

fix

Update the import statement to `from flask_basicauth import BasicAuth`

401 UNAUTHORIZED

This HTTP status code indicates that the client failed to provide valid authentication credentials (username and password) required to access the resource, or the provided credentials were incorrect. This can be due to misconfigured `BASIC_AUTH_USERNAME` or `BASIC_AUTH_PASSWORD`, or issues with proxies not forwarding authentication headers.

fix

Ensure `app.config['BASIC_AUTH_USERNAME']` and `app.config['BASIC_AUTH_PASSWORD']` are correctly set in your Flask application, and that the client is sending the correct credentials. If using a proxy (like Nginx or Apache), ensure it's configured to pass authorization headers (e.g., `proxy_pass_header Authorization;` in Nginx or `WSGIPassAuthorization On` in Apache/mod_wsgi).

AttributeError: 'BasicAuth' object has no attribute 'init_app'

This usually happens when `init_app` is called on an object that is not an instance of `BasicAuth` (e.g., if `basic_auth` was accidentally assigned `None`), or if there's a typo in the method call. The `BasicAuth` object is typically initialized by passing the Flask app instance directly or by calling `init_app` on an uninitialized `BasicAuth` object.

fix

Ensure the `BasicAuth` object is correctly instantiated and associated with your Flask app. Either pass the app directly: `basic_auth = BasicAuth(app)`, or initialize it separately: `basic_auth = BasicAuth(); basic_auth.init_app(app)`.

Upgrade

Version history

0.2.0latest on PyPI · released Jun 15, 2013

Audit

Dependencies

FlaskrequiredCore web framework dependency for the extension.

Agent activity

17 hits · last 30 days

node

Amazon

OpenAI (training)

Resources

githubhttps://github.com/jpvanhal/flask-basicauth ↗

packagehttps://pypi.org/project/flask-basicauth/ ↗