We've been developing a Flask app for a customer and a part of the agreement was that "customer admins" would be allowed to access Flask admin page to manage users, roles and business entities.

The admin functionality is based on flask-admin package and we are using flask-jwt-extended keeping the access token in the cookies. The passwords are pbkdf2:sha256-hashed with a salt; neither passwords, nor password hashes are ever shown in the admin. Everything is HTTPS.

One other thing we did was moving from the default admin/ to a custom endpoint name.

What else could we do to make the Flask admin page more secure?

Please let me know if any other details are needed.

1 Answer 1


In general, flask-admin is not different to any other web app and you need to follow general application security guidelines. The OWASP Top 10 is a good introduction and there are more detailed guides too.

If you've written your own controller code it could be vulnerable to flaws like SQL injection.

To configure flask-admin securely, enable CSRF protection

Make sure you have detailed logging of actions within the admin area, which include application layer actions not just HTTP logs, and are connected to user IDs.

Securing authentication is important. You could consider using MFA, and possibly IP restricting admin access. In addition to password hashing, you want a decent lockout policy, password strength checks, and to ensure your forgotten password process doesn't undermine this.

  • 2
    this answer is excellent other stuff worth considering would be: - just blocking IP access if possible to admin pages (is the customer only likely to access this from internal IPs anyway?) - applying a WAF(security band-aid, they're not bulletproof) like modsecurity or similar to the admin pages (easier than the whole app).
    – pacifist
    Jan 5, 2019 at 0:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .