Protecting Flask-Admin Routes using Flask-Praetorian

Viewed 634

I am using Flask-Praetorian to provide my Flask API server with user authentication and route protection features.

After installing Flask-Admin to the app, I notice that the /admin routes are not protected by user authentication.

How can we use Flask-Praetorian to secure the routes of Flask-Admin?

Using Python 3.7.4, Flask 1.1.1, flask-praetorian 1.0.0, Flask-Admin 1.5.4, Flask-SQLAlchemy 2.4.1

from flask_sqlalchemy import SQLAlchemy
from flask_praetorian import Praetorian
from flask_admin import Admin

db = SQLAlchemy()
guard = Praetorian()
admin = Admin()

class User(db.Model):
    __tablename__ = 'users'
    id = db.Column(db.Integer, primary_key=True)

    ...


def create_app():
    app = Flask(__name__)

    db.init_app(app)
    guard.init_app(app, User)
    admin.init_app(app)

    # Example of protected route
    @app.route('/protected', methods=['GET'])
    @auth_required
    def protected():
        return jsonify({'logged_in': 'true'})

    return app
0 Answers
Related