Sure -- Flask-Security is really excellent. I should have included it in the first part of this series. Essentially, Flask-Security is doing the same thing as

Sure -- Flask-Security is really excellent. I should have included it in the first part of this series. Essentially, Flask-Security is doing the same thing as Flask-Stormpath, but is a lot more flexible -- it allows you to store users however you want with Postgres, Mongo, or whatever backend database you like. It also comes with some good examples (of how to create a users table for Postgres, etc.). The benefit to Flask-Stormpath is a few things: - You have a pre-defined user model that is really flexible (you can do email or username login / auth). - You get greater security for authentication stuff (we use a really secure digest authentication method which prevents various attacks: MITM stuff, replay attacks, timing attacks, etc.). - We also provide a flexible (and scalable) key-value store for all your user data (up to 10mb of data, per user account, completely free), so you can do cool stuff like this: >>> my_user.custom_data['blah'] = { 'something': { 'more_stuff': 999.999, 'woot': 'hiya!', }, } >>> my_user.save() All your user information (and user data), is hosted, backed up, encrypted, and provided via a fast, REST API. This means that you can do cool stuff like: - Access your user data from many parts of your stack (without sharing databases, or doing other hacks). This is really great if you're building a service-oriented application. - Scale your userbase up from a few users to millions, no issues whatsoever. And lastly, Stormpath also provides a really complete permissions model: - You can encapsulate users in unique containers (directories), then map those directories to applications to make them 'active'. - You get out of the box email verification and password reset stuff. - You can require passwords to have various levels of complexity (length, types of characters, etc.). - You can put users into groups (many-to-many), which scales particularly well on our backend -- a great way to build complicated authorization hierarchies. Hopefully that helps answer your questions. SUMMARY: Flask-Security is probably the very best possible, purely open source, and flexible, application that exists. Flask-Stormpath is built on top of the Stormpath API, so as a benefit, can do a lot of stuff that isn't possible for Flask-Security to do.