User Login

Setting up Flask-Login

This plugin will make it super easy
for us to log users in and out.

Install the flask-login plugin

pip install flask-login

Python plugins need to be
installed from the shell.

Ready for use

We can now use it by importing the
flask-login package wherever we need.

Create a usermanager file

In your website’s public folder,
create a new file usermanager.py

Import your website

from public import website

Import your message-board Flask website
at the top of your usermanager.py file.

Import flask login

from public import website
from flask.ext import login as flask_login

Also import the flask-login plugin
so we can use the additional functionality.

Add a secret key

from public import website
from flask.ext import login as flask_login

website.secret_key = 'super secret string' 

This is a requirement of flask-login
which we need to avoid errors.

Initialise flask login

from public import website
from flask.ext import login as flask_login

website.secret_key = 'super secret string' 

login_manager = flask_login.LoginManager()
login_manager.init_app(website)

Create an instance of the login manager
and pass it a reference to your web app.

Check website works

Open your website in the browser and
click through pages to check they still work.

Your site should work, with nothing changed.

Create a User class

The flask-login plugin requires that we have
a User class with a set of predefined functions.

Create a User class

login_manager = flask_login.LoginManager()
login_manager.init_app(website)

class User(flask_login.UserMixin):

    def __init__(self, username, password):
        self.username = username
        self.password = password
        self.authenticated = False

In your user manager after the login manager setup code,
create a User class which requires a username and password.

Add a function to get the id

class User(flask_login.UserMixin):

    def __init__(self, username, password):
        self.username = username
        self.password = password
        self.authenticated = False

    def get_id(self):
        return self.username

The flask-login plugin needs to be able to
access a unique id for every user.

Add a function to check authentication

    def __init__(self, username, password):
        self.username = username
        self.password = password
        self.authenticated = False

    def get_id(self):
        return self.username

    def is_authenticated(self):
        return self.authenticated

In our app, if we find a user in the database
we assume they are authenticated so always return True.

Add a function to check if a user is active

    def __init__(self, username, password):
        self.username = username
        self.password = password
        self.authenticated = False
        
    def get_id(self):
        return self.username

    def is_authenticated(self):
        return self.authenticated

    def is_active(self):
        return True

In our app, every user who exists can be treated
as an “active” user, so always return true.

Add a function to check if a user is anonymous

def get_id(self):
    return self.username

def is_authenticated(self):
    return self.authenticated

def is_active(self):
    return True

def is_anonymous(self):
    return False

Our app doesn’t support anonymous users,
so this function always returns False.

Check your User class structure is correct

class User(flask_login.UserMixin):

    def __init__(self, username, password):
        self.username = username
        self.password = password
        self.authenticated = False

    def get_id(self):
        return self.username

    def is_authenticated(self):
        return self.authenticated

    def is_active(self):
        return True

    def is_anonymous(self):
        return False

Your finished User class should look like this.

Create a user loader function

The flask-login plugin also requires us to have a
function which can load a user based on their username.

Create a dummy user loader function

@login_manager.user_loader
def load_user(username):
    return None

In your usermanager file, create a placeholder
function called load_user which returns None.

Site should work

Open your site in the browser and check
that everything is still working.

Your site should work, but still no change!

Restrict access to pages

We can make certain pages of our site
only accessible for logged in users.

Import the “login required” mixin

from flask.ext.login import login_required

In the usermanager import login_required,
a mixin we can apply to routes to restrict access.

Import the user manager into routes

from public import usermanager

This will allow us to use the login_required mixin
and other functions we defined in the usermanager.

Add “login required” to the new message page

@website.route('/new-message')
@usermanager.login_required
def new_message():
    return render_template('new-message.html')

This tells Flask that login is required
to access the new_message route.

Check access is restricted

Navigate to the new-message page in your browser
to check that access is restricted.

You should see an “Unauthorized” notice.

Set the login page

login_manager = flask_login.LoginManager()
login_manager.init_app(website)

login_manager.login_view = "sign_in"

This tells the flask-login plugin where people
should be sent if they are not logged in and
try to access a restricted page.

Check the login redirect works

Try to navigate to the restricted “new message” page
and check that you are redirected to the login page.

Restricted pages should redirect to the login page.

Create function to sign in users

This function in usermanager will take a
username and password, then return a signed in user.

Add the “sign_in_user” function to usermanager

def sign_in_user(username, password):

    user = load_user(username)

    if user and user.password == password:
      user.authenticated = True
      flask_login.login_user(user)

    return flask_login.current_user

This function creates an actual User object
and logs that user in using flask-login.

Check your app runs

Run your website and click around
to check for any new errors.

Your website should run and be error-free.

Authenticate the user

When the user signs in, we need to process the
username and password they entered in the form.

Use the username and password to authenticate

if request.method == 'POST':

    username = request.form.get('username')
    password = request.form.get('password')

    user = usermanager.sign_in_user(username, password)

Modify your sign-in route to pass the username
and password to the sign_in_user function.

Redirect based on the result

if request.method == 'POST':

    username = request.form.get('username')
    password = request.form.get('password')

    user = usermanager.sign_in_user(username, password)

    if user.is_authenticated():
        return redirect('/')
    else:
        return render_template('sign-in.html')

If the user exists, they will be authenticated
and we can redirect them to the home page.

If they don’t exist, we keep them on the sign in page.

Import the redirect package

from flask import redirect

Import the redirect package
at the top of routes.py

Check your site works

Everything should work as normal, except that
signing in will always keep you on the sign in page.

Implement the user loader function

We have a function to load a user but it
always returns None, it should return a user.

Import the datamanager into the usermanager

from public import datamanager

Import the data manager so that we can
access the database to look up a user.

Write a query to find the user

@login_manager.user_loader
def load_user(username):

    query_string = (
      'SELECT user_id, username, password, first_name, last_name ' 
      'FROM users '
      'WHERE username = ?'
    )

The query is fairly straightforward, but we also
included a question mark so we can pass in a username.

Run the query, passing it the username parameter

@login_manager.user_loader
def load_user(username):

    query_string = (
      'SELECT user_id, username, password, first_name, last_name ' 
      'FROM users '
      'WHERE username = ?'
    )

    query_result = datamanager.query_db(query_string, [username], one=True)

If the query fails then return None

@login_manager.user_loader
def load_user(username):

    query_string = (
      'SELECT user_id, username, password, first_name, last_name ' 
      'FROM users '
      'WHERE username = ?'
    )

    query_result = datamanager.query_db(query_string, [username], one=True)

    if query_result == None:
        return None

If the query succeeds then create and return a User

    query_result = datamanager.query_db(query_string, [username], one=True)

    if query_result == None:
        return None

    else:
        user = User(
            query_result['username'],
            query_result['password']
        )

        return user

Attach the additional optional user info

query_result = datamanager.query_db(query_string, [username], one=True)

if query_result == None:
    return None

else:
    user = User(
        query_result['username'],
        query_result['password']
    )

    user.user_id = query_result['user_id']
    user.first_name = query_result['first_name']
    user.last_name = query_result['last_name']

    return user

We can also store the user’s user_id
and their first and last name on the User.

Site should be working

Check your site is working
and sign in is supported.

You should be able to log in to your website.

Signing in should allow access to new messages

Check that once you’ve signed in
you can access the new message page.

Sign out user

Now we can also add functionality
for a user to sign out.

Create sign out route

# sign out page
@website.route('/sign-out')
def sign_out():
    return render_template('sign-out.html')

Create sign_out_user function

In usermanager.py:

def sign_out_user():
    flask_login.logout_user()

Call sign out function from route

# sign out page
@website.route('/sign-out')
def sign_out():
    usermanager.sign_out_user()
    return render_template('sign-out.html')

Test that you can sign in and sign out

Password encryption

You should totes encrypt passwords
but we’re not doing it today

Using user data in templates

We can display user data, or use their info
to show and hide elements on a page.

Displaying a username

{% if current_user.is_authenticated %}
    Hello {{ current_user.username }}
{% endif %}

Smart sign in / sign out links

<nav>

    <a href="/">Home</a>
    <a href="/new-message">New Message</a>

    {% if current_user.is_authenticated %}
      <a href="/sign-out">Sign out</a>
    {% else %}
      <a href="/sign-in">Sign in</a>
    {% endif %}

</nav>

User Login: Complete!

Take me to the next chapter!