Disable Login Route/Force User to change password

[zfish85]

Hi there,

I'm working on app that is secured by Flask-Security-Too. The app is planned as Micro-SaaS and to run in small networks. Thus, I designed it like that: An admin has to create a user with an (initial) password. When the user logs in for the first time, the initial password should be changed. E-Mail/Token based registration would be too much in this context. I have already created a "password-changed" column in the database. Users, that have not changed their initial password, should be redirected to a page, where they have to enter the initial password and a new password twice. If valid, the password will be changed and password_changed will set to true.

However, I was wondering how I can overwrite the Flask-Security-Too Login route, to implement this logic. Any ideas?

[jwag956]

Here's an idea that should be pretty straightforward to try out.

First - subclass LoginForm and add a validate() method. This method should:

1. call the super class validate and if that returns True that means the user has entered the correct 'preset' password.
2. the form.user (self.user) will be set to the user record - so your validate routine can simply check if !user.password_changed - and if false, add a custom error message: self.email.errors.append(custom error). This will cause the /login endpoint to NOT login the user and return the error.
   Then:
   In your login template you can check for this error and do a redirect. The simplest (though maybe not the best UX) would be to redirect to /reset which will allow the user to get an email and can reset their password.

[zfish85]

Thank you so much, this works well. :)