We've been developing a Flask app for a customer and a part of the agreement was that "customer admins" would be allowed to access Flask admin page to manage users, roles and business entities.
The admin functionality is based on
flask-admin package and we are using
flask-jwt-extended keeping the access token in the cookies. The passwords are
pbkdf2:sha256-hashed with a salt; neither passwords, nor password hashes are ever shown in the admin. Everything is HTTPS.
One other thing we did was moving from the default
admin/ to a custom endpoint name.
What else could we do to make the Flask admin page more secure?
Please let me know if any other details are needed.