Flask-Security-Too quickly adds common security features like user registration, login, roles, and password management to your Flask application. Currently at version 5.8.0, it's the actively maintained successor to the original Flask-Security, frequently releasing updates with fixes and improvements. Despite the 'too' suffix in its PyPI name, it is now the official Flask-Security project under Pallets-Eco.
Install & Compatibility
Where this runs
tested against v5.8.1 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslpy 3.10–3.940 runs
installs and imports cleanly · install 0.0s · import 1.502s · 58.5MB
glibcpy 3.10–3.940 runs
installs and imports cleanly · install 4.9s · import 1.437s · 57MB
58MB installed
● package 58MB
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
Despite the PyPI package name `flask-security-too`, the Python module name is `flask_security`.
from flask_security import Security
from flask_security import SQLAlchemySessionUserDatastore
from flask_security import UserMixin
from flask_security import RoleMixin
This quickstart sets up a basic Flask application with Flask-SQLAlchemy and Flask-Security-Too, enabling user registration and login functionality. It defines simple User and Role models and initializes the `Security` extension with a `SQLAlchemySessionUserDatastore`. Remember to set `FLASK_SECRET_KEY` and `SECURITY_PASSWORD_SALT` environment variables in production.
import os
from flask import Flask
from flask_sqlalchemy import SQLAlchemy
from flask_security import Security, SQLAlchemySessionUserDatastore, UserMixin, RoleMixin
# Configure Flask app
app = Flask(__name__)
app.config['DEBUG'] = True
app.config['SECRET_KEY'] = os.environ.get('FLASK_SECRET_KEY', 'super-secret-dev-key')
app.config['SQLALCHEMY_DATABASE_URI'] = 'sqlite:///test.db'
app.config['SQLALCHEMY_TRACK_MODIFICATIONS'] = False
app.config['SECURITY_PASSWORD_SALT'] = os.environ.get('SECURITY_PASSWORD_SALT', 'some-random-salt')
# Initialize SQLAlchemy
db = SQLAlchemy(app)
# Define User and Role models
roles_users = db.Table(
'roles_users',
db.Column('user_id', db.Integer, db.ForeignKey('user.id')),
db.Column('role_id', db.Integer, db.ForeignKey('role.id'))
)
class Role(db.Model, RoleMixin):
id = db.Column(db.Integer, primary_key=True)
name = db.Column(db.String(80), unique=True)
description = db.Column(db.String(255))
class User(db.Model, UserMixin):
id = db.Column(db.Integer, primary_key=True)
email = db.Column(db.String(255), unique=True)
password = db.Column(db.String(255))
active = db.Column(db.Boolean())
fs_uniquifier = db.Column(db.String(64), unique=True, nullable=False)
roles = db.relationship('Role', secondary=roles_users, backref=db.backref('users', lazy='dynamic'))
# Setup Flask-Security
user_datastore = SQLAlchemySessionUserDatastore(db.session, User, Role)
security = Security(app, user_datastore)
@app.before_first_request
def create_user():
db.create_all()
if not user_datastore.find_user(email='test@example.com'):
user_datastore.create_user(email='test@example.com', password='password')
db.session.commit()
@app.route('/')
def home():
return 'Hello, Flask-Security-Too! Go to /login or /register.'
if __name__ == '__main__':
app.run()
Upgrade
Version history
Breaking-change detection hasn't run for this library yet.
Audit
Security & dependencies
CVE tracking and dependency tree are planned for a later release.