Registry / web-framework / flask-httpauth

flask-httpauth

library4.8.1pypypi✓ verified 25d ago

Flask-HTTPAuth is a Flask extension that simplifies the use of HTTP authentication with Flask routes. It currently supports Basic, Digest, and Token authentication schemes. The library is actively maintained with regular releases, typically every few months, ensuring compatibility with the latest Flask versions and addressing security concerns.

web-framework auth-security

pip install Flask-HTTPAuth

github ↗package ↗

INSTALL

IMPORT

SIG · FLASK-HTTPAUTH

flask-httpauth

web-frameworkpythonv4.8.1

Install

2.3s avg

Import

474ms

Disk

21MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v4.8.1 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.492s · 22.5MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 2.3s · import 0.456s · 23MB

21MB installed

● package 21MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

HTTPBasicAuth

✓ from flask_httpauth import HTTPBasicAuth

✗ from flask.ext.httpauth import HTTPBasicAuth

The `flask.ext` import style was deprecated in Flask 0.9 and removed in Flask 1.0. Use `flask_httpauth` directly.

HTTPDigestAuth

✓ from flask_httpauth import HTTPDigestAuth

HTTPTokenAuth

✓ from flask_httpauth import HTTPTokenAuth

This quickstart demonstrates basic HTTP authentication using `HTTPBasicAuth` and `verify_password` for secure password handling. It uses environment variables for mock user passwords for demonstration purposes, which should be replaced by a secure user management system in production.

import os from flask import Flask, jsonify from flask_httpauth import HTTPBasicAuth from werkzeug.security import generate_password_hash, check_password_hash app = Flask(__name__) auth = HTTPBasicAuth() # In a real application, fetch from a database or secure configuration users = { "john": generate_password_hash(os.environ.get('JOHN_PASSWORD', 'hello')), "susan": generate_password_hash(os.environ.get('SUSAN_PASSWORD', 'bye')) } @auth.verify_password def verify_password(username, password): if username in users and \ check_password_hash(users.get(username), password): return username return None @app.route('/') @auth.login_required def index(): return f"Hello, {auth.current_user()}! You are authenticated." @app.route('/public') def public_route(): return "This is a public route." if __name__ == '__main__': # Example of setting environment variables for quick testing: # export JOHN_PASSWORD=secret_john # export SUSAN_PASSWORD=secret_susan app.run(debug=True)

Debug

Known issues

breakingVersion 4.0.0 dropped support for Python 2.x. Applications running on Python 2 must either remain on `flask-httpauth<4.0.0` or upgrade to Python 3.

fix

Upgrade your application to Python 3. If a Python 3 upgrade is not feasible, pin `Flask-HTTPAuth<4.0.0`.

affects: >=4.0.0

breakingIn version 4.0.0, the `auth.username()` method was renamed to `auth.current_user()` to align with more generic authentication contexts (e.g., token-based authentication where the 'username' might not be directly applicable).

fix

Replace all calls to `auth.username()` with `auth.current_user()`.

affects: >=4.0.0

gotchaFor secure password handling, it is highly recommended to use the `@auth.verify_password` decorator with hashed passwords (e.g., `werkzeug.security.generate_password_hash`, `check_password_hash`). Relying on `@auth.get_password` with plain-text passwords is insecure and should be avoided.

fix

Implement password hashing using `werkzeug.security` or similar libraries. Ensure `@auth.verify_password` performs a hash comparison, not a plain-text comparison.

affects: All

gotchaWhen using `HTTPDigestAuth`, Flask's `SECRET_KEY` configuration must be set, and for robust security, server-side sessions should be used instead of the default client-side (cookie-based) sessions to prevent exposure of challenge data.

fix

Set `app.config['SECRET_KEY'] = 'your-secret-key'` and consider configuring Flask to use server-side sessions for production deployments involving `HTTPDigestAuth`.

affects: All

breakingThe default value of `auth.login_message` changed from a generic 'Login Required' string to `None` in version 4.0.0. If your application relied on the default message being displayed, it will no longer appear unless explicitly set.

fix

If a custom login message is desired, explicitly set `auth.login_message = 'Your custom message'` during initialization or via a decorator parameter.

affects: >=4.0.0

Errors

Common errors & fixes

ModuleNotFoundError: No module named 'flask_httpauth'

This error occurs when the 'flask-httpauth' package is not installed in the Python environment being used, or when there's a conflict in virtual environments, or if an old, deprecated import path (like `flask.ext.httpauth`) is still being used.

fix

First, ensure the package is installed: `pip install Flask-HTTPAuth`. If in a virtual environment, make sure it's activated. If upgrading from an older Flask version that used `flask.ext.httpauth`, update the import statement to `from flask_httpauth import HTTPBasicAuth` (or `HTTPTokenAuth`, etc.).

AttributeError: 'function' object has no attribute 'verify_password'

This error typically means that the `@auth.verify_password` decorator was applied to a function before the `auth` object (an instance of `HTTPBasicAuth` or `HTTPTokenAuth`) was properly initialized or imported, or there's a name collision where 'auth' is incorrectly referencing a function or module instead of the `HTTPBasicAuth` instance.

fix

Ensure that `auth = HTTPBasicAuth()` is defined and initialized correctly before any functions are decorated with `@auth.verify_password`. If you have a file or function named 'auth', rename it to avoid conflict.

401 Unauthorized (missing WWW-Authenticate header)

While not a Python traceback, a common functional issue is receiving a '401 Unauthorized' HTTP response from the server, often without the browser prompting for credentials, because the `WWW-Authenticate` header is not correctly set in the response. This prevents clients (like web browsers) from knowing how to authenticate.

fix

Implement a custom error handler for 401 status codes using `@app.errorhandler(401)` that returns a `Response` object with the correct `WWW-Authenticate` header. Flask-HTTPAuth's `auth.error_handler` can also be used to customize this response. Example: `return Response('Could not verify your access level!', 401, {'WWW-Authenticate': 'Basic realm="Login Required"'})`

ImportError: cannot import name HTTPTokenAuth

This error usually indicates that the installed version of `Flask-HTTPAuth` is too old and does not include the `HTTPTokenAuth` class, or there's an issue with the Python environment not picking up the correct version after an upgrade.

fix

Upgrade `Flask-HTTPAuth` to a newer version that supports `HTTPTokenAuth` (version 3.1.0 or newer) using `pip install Flask-HTTPAuth --upgrade`. Ensure your virtual environment is active during the upgrade and when running the application.

Upgrade

Version history

4.8.1latest on PyPI · released Mar 28, 2026

Audit

Dependencies

FlaskrequiredCore dependency for the Flask framework.

WerkzeugrequiredUsed for security utilities like password hashing; it's a core Flask dependency.

Agent activity

20 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/miguelgrinberg/flask-httpauth ↗

packagehttps://pypi.org/project/flask-httpauth/ ↗