Mastering Flask Web Development - Second Edition

Securing Flask Admin

Currently, the entire admin interface is accessible to the world—let's fix that. The routes in the CustomView can be secured just like any other route, as follows:

class CustomView(BaseView): 
    @expose('/') 
    @login_required 
    @has_role('admin') 
    def index(self): 
        return self.render('admin/custom.html') 
 
    @expose('/second_page') 
    @login_required     @has_role('admin') 
    def second_page(self): 
        return self.render('admin/second_page.html') 

To secure the ModeView and FileAdmin subclasses, they need to have a method named is_accessible defined, which either returns true or false:

class CustomModelView(ModelView): def is_accessible(self): return current_user.is_authenticated and current_user.has_role('admin') class CustomFileAdmin(FileAdmin): ...