To add user authentication to a Flask application, you will need to manage user registration, login/logout functionality, store user account information, and protect routes that require a logged in user.

The first step is to decide how you will store user account information like usernames, passwords, etc. A common approach is to use a SQL database like SQLite. You can create a database model to represent a user account using Flask-SQLAlchemy. The model should include at minimum a username, password hash, and any other profile fields you want to store.

For example:

python
Copy
from flask_sqlalchemy import SQLAlchemy

db = SQLAlchemy()

class User(db.Model):
id = db.Column(db.Integer, primary_key=True)
username = db.Column(db.String(80), unique=True, nullable=False)
password = db.Column(db.String(255), nullable=False)

Next, you need to set up user registration views and forms. Create a RegistrationForm that validates the username and password fields. Then add a route and view to handle POST requests to /register:

python
Copy
from flask_wtf import FlaskForm
from wtforms import StringField, PasswordField
from wtforms.validators import DataRequired, Length, EqualTo

class RegistrationForm(FlaskForm):
username = StringField(‘Username’, validators=[DataRequired(), Length(min=2, max=20)])
password = PasswordField(‘Password’, validators=[DataRequired()])
confirm_password = PasswordField(‘Confirm Password’, validators=[DataRequired(), EqualTo(‘password’)])

# route to handle form submission
@app.route(‘/register’, methods=[‘GET’, ‘POST’])
def register():

form = RegistrationForm()

if form.validate_on_submit():
user = User(username=form.username.data, password=generate_password_hash(form.password.data))
db.session.add(user)
db.session.commit()
return redirect(url_for(‘login’))

return render_template(‘register.html’, form=form)

To authenticate users on login, you need to securely hash and store passwords in the database. Use the Python password hashing library passlib.hash() to hash passwords on registration, and compare hashed passwords on login using passlib.check_password_hash().

For the login route, you can create a LoginForm similar to the registration form, then query the database to check if a user with that username exists and the passwords match:

python
Copy
from passlib.hash import pbkdf2_sha256

#…

class LoginForm(FlaskForm):
username = StringField(‘Username’, validators=[DataRequired()])
password = PasswordField(‘Password’, validators=[DataRequired()])

@app.route(‘/login’, methods=[‘GET’, ‘POST’])
def login():

form = LoginForm()

if form.validate_on_submit():

user = User.query.filter_by(username=form.username.data).first()

if user and pbkdf2_sha256.verify(form.password.data, user.password):
login_user(user)
return redirect(url_for(‘home’))

return render_template(‘login.html’, form=form)

To keep users logged in across sessions, you can use the Flask-Login extension. It provides a login_user() function to log users in, and current_user to access the logged in user object in views.

Import Flask-Login, set up the LoginManager, and define a UserMixin class to represent the user object:

python
Copy
from flask_login import LoginManager, UserMixin, login_user, login_required, current_user

login_manager = LoginManager()
login_manager.init_app(app)

@login_manager.user_loader
def load_user(user_id):
return User.query.get(int(user_id))

class User(UserMixin, db.Model):
#…

Now decorate any route that requires a logged in user with @login_required. The user will be redirected to login if not authenticated.

You also need to add a logout route:

python
Copy
@app.route(‘/logout’)
@login_required
def logout():
logout_user()
return redirect(url_for(‘login’))

To recap, user authentication in Flask involves:

User models and database setup
Registration and login forms + routes
Password hashing
Flask-Login for session management
login_required decorator
Routes for logout

Following these steps allows you to manage users, restrict access to authenticated users only, and easily add additional authentication methods like OAuth in the future. With Flask and these extensions, user authentication can be implemented securely and scalably in any Flask application.