3 ms·
Heya, author here. If you have any questions, I'm happy to answer them.
by rdegges 13y ago
Heya, author here. If you have any questions, I'm happy to answer them.
- zeckalpha 13y agoI didn't know there was a "problem" with Flask authentication, but otherwise I'm looking forward to your work at Stormpath!
- dvanduzer 13y agoFlask's "problem" with authentication is that it refuses to deal with the broader Identity problem that plagues all networked systems. Matt did some great work integrating some of the pre-existing pieces (including one by another Matt) into a one size fits many solution: https://pythonhosted.org/Flask-Social/ https://pythonhosted.org/Flask-Social/ But regardless of language / platform / framework, you still have to contend with the fact that OAuth and OpenID exist, and SAML is somewhere in there too, all sitting on top of legacy systems speaking LDAP and Kerberos negotiated with SASL along with some other oddball one-offs thrown in for good measure. BrowserID looks cool too. And what about two-factor? So enter StormPath as yet another vendor to help solve this problem. It isn't a problem with Flask but if you're entering this market to solve the problem once and for all, it's very nice to see you paying attention to Flask.
- makmanalp 13y agoGreat work! Mind doing a compare / contrast with flask-security? (First comes to mind is that flask-security is a mix-match of a bunch of libraries) https://pythonhosted.org/Flask-Security/ https://pythonhosted.org/Flask-Security/
- rdegges 13y agoSure -- Flask-Security is really excellent. I should have included it in the first part of this series. Essentially, Flask-Security is doing the same thing as Flask-Stormpath, but is a lot more flexible -- it allows you to store users however you want with Postgres, Mongo, or whatever backend database you like. It also comes with some good examples (of how to create a users table for Postgres, etc.). The benefit to Flask-Stormpath is a few things: - You have a pre-defined user model that is really flexible (you can do email or username login / auth). - You get greater security for authentication stuff (we use a really secure digest authentication method which prevents various attacks: MITM stuff, replay attacks, timing attacks, etc.). - We also provide a flexible (and scalable) key-value store for all your user data (up to 10mb of data, per user account, completely free), so you can do cool stuff like this: >>> my_user.custom_data['blah'] = { 'something': { 'more_stuff': 999.999, 'woot': 'hiya!', }, } >>> my_user.save() All your user information (and user data), is hosted, backed up, encrypted, and provided via a fast, REST API. This means that you can do cool stuff like: - Access your user data from many parts of your stack (without sharing databases, or doing other hacks). This is really great if you're building a service-oriented application. - Scale your userbase up from a few users to millions, no issues whatsoever. And lastly, Stormpath also provides a really complete permissions model: - You can encapsulate users in unique containers (directories), then map those directories to applications to make them 'active'. - You get out of the box email verification and password reset stuff. - You can require passwords to have various levels of complexity (length, types of characters, etc.). - You can put users into groups (many-to-many), which scales particularly well on our backend -- a great way to build complicated authorization hierarchies. Hopefully that helps answer your questions. SUMMARY: Flask-Security is probably the very best possible, purely open source, and flexible, application that exists. Flask-Stormpath is built on top of the Stormpath API, so as a benefit, can do a lot of stuff that isn't possible for Flask-Security to do.