Securing Your Python App with User Authentication

Table of Contents

  1. Introduction
  2. Prerequisites
  3. Setting Up the Environment
  4. Creating the Login Page
  5. Validating User Credentials
  6. Implementing User Authentication
  7. Creating Restricted Pages
  8. Conclusion

Introduction

In this tutorial, we will learn how to secure a Python web application by implementing user authentication. User authentication is an essential feature in any web application that requires restricted access to certain pages or functionality. By the end of this tutorial, you will be able to build a login page, validate user credentials, implement user authentication, and create restricted pages accessible only to authenticated users.

Prerequisites

To follow along with this tutorial, it is recommended to have a basic understanding of Python and web development concepts. Familiarity with HTML, CSS, and Python frameworks such as Flask or Django will be beneficial. Additionally, make sure Python and the required libraries are installed on your system.

Setting Up the Environment

Before we start building the authentication system, let’s set up the environment. Follow these steps:

  1. Open your terminal or command prompt.
  2. Create a new directory for your project: mkdir secure-app.
  3. Navigate to the project directory: cd secure-app.
  4. Create a virtual environment: python3 -m venv venv.
  5. Activate the virtual environment:
    • For Windows: venv\Scripts\activate.
    • For Linux/Mac: source venv/bin/activate.

Now that the environment is set up, we can begin building our secure Python app.

Creating the Login Page

The first step is to create a login page where users can enter their credentials. We will use HTML and CSS for this purpose. Here’s an example of a basic login page: html <!DOCTYPE html> <html> <head> <title>Login</title> <style> /* Add CSS styles to enhance the appearance of the login page */ </style> </head> <body> <h1>Login</h1> <form action="/authenticate" method="POST"> <label for="username">Username:</label> <input type="text" id="username" name="username" required><br><br> <label for="password">Password:</label> <input type="password" id="password" name="password" required><br><br> <input type="submit" value="Login"> </form> </body> </html> Save this HTML code in a file named login.html. Feel free to add CSS styles to make the login page visually appealing.

Validating User Credentials

Once the user submits the login form, we need to validate their credentials. In this section, we will create a Python function to handle the authentication process. Follow these steps:

  1. Create a new Python file named app.py in your project directory.
  2. Import the required modules: 
     from flask import Flask, render_template, request
  3. Initialize a Flask app: 
     app = Flask(__name__)
  4. Create a route for the login page: 
     @app.route('/')
 def login():
     return render_template('login.html')
  5. Add a route to handle the authentication request: 
     @app.route('/authenticate', methods=['POST'])
 def authenticate():
     username = request.form['username']
     password = request.form['password']
	
     # Implement the logic to validate the user credentials
	
     return 'Authentication Successful'

    In the authenticate function, we retrieve the username and password entered by the user using request.form. Here, you can implement the logic to validate the credentials against a database or any other authentication mechanism.

Implementing User Authentication

To implement user authentication, we will use session-based authentication with Flask. Sessions allow us to store user-specific information that can be accessed across multiple requests. Follow these steps to implement user authentication:

  1. Add the following import statement at the top of your app.py file: 
     from flask import session
  2. Generate a secret key for your Flask app. Choose a random string and add it to your app.py file: 
     app.secret_key = 'your-secret-key'
  3. Update the authenticate function to handle user authentication: 
     @app.route('/authenticate', methods=['POST'])
 def authenticate():
     username = request.form['username']
     password = request.form['password']
	
     # Implement the logic to validate the user credentials
	
     if valid_credentials:
         session['username'] = username  # Store the username in the session
         return 'Authentication Successful'
     else:
         return 'Authentication Failed'

    In this example, we assume that valid_credentials is a variable that holds the result of the credential validation process. If the credentials are valid, we store the username in the session using session['username'].

Creating Restricted Pages

Now that we have implemented user authentication, let’s create a restricted page that can only be accessed by authenticated users. Follow these steps:

  1. Create a new HTML file named restricted.html: 
     <!DOCTYPE html>
 <html>
 <head>
     <title>Restricted Page</title>
 </head>
 <body>
     <h1>Welcome, </h1>
     <p>This is a restricted page.</p>
 </body>
 </html>
  2. Update your app.py file to add a route for the restricted page: 
     @app.route('/restricted')
 def restricted():
     if 'username' in session:
         return render_template('restricted.html')
     else:
         return 'Access Denied'

    In the restricted function, we check whether the username exists in the session. If it does, we render the restricted.html template. Otherwise, we deny access to the page.

Conclusion

In this tutorial, we learned how to secure a Python web application by implementing user authentication. We covered the steps to create a login page, validate user credentials, implement user authentication using sessions, and create restricted pages accessible only to authenticated users. By following this tutorial, you should now have a basic understanding of how to secure your Python app with user authentication. Happy coding!

Published:

Related Articles