Category: Uncategorized

Looking to supercharge your web‑automation projects with a modern, reliable tool? Python Playwright has quickly become the go‑to framework for developers who need fast, cross‑browser automation without the headaches of flaky tests. In this guide we’ll walk through everything you need to know—from installation and a simple “Hello, World” script to advanced techniques like auto‑waiting, tracing, and seamless pytest integration. Whether you’re building a data‑scraping pipeline, a UI test suite, or a headless bot, this comprehensive tutorial will give you the confidence to write clean, maintainable automation code that scales.

What Is Playwright and Why Choose It for Python?

Playwright is an open‑source automation library created by Microsoft that supports Chromium, Firefox, and WebKit with a single API. Its key advantages over older tools such as Selenium include:

• Auto‑waiting: No more manual time.sleep()—Playwright waits for elements to be ready before interacting.
• Cross‑browser consistency: Write once, run on Chrome, Edge, Safari, and Firefox without code changes.
• Built‑in network interception: Mock responses, block ads, or capture traffic for debugging.
• Powerful tracing: Generate step‑by‑step videos and screenshots to pinpoint failures.
• Headless and headed modes: Switch easily for CI pipelines or local debugging.

All of these features are exposed through a clean, Pythonic API that feels natural to anyone familiar with asyncio or synchronous code.

Getting Started: Installing Playwright for Python

Playwright can be installed via pip. The package includes both the Python bindings and a helper script that downloads the browser binaries.

pip install playwright
python -m playwright install

For projects that prefer asynchronous execution (recommended for speed), also install the asyncio extra:

pip install "playwright[async]"

Once installed, you’re ready to launch your first browser instance.

Writing Your First Playwright Script

Sync vs. Async: Which Style to Use?

Playwright offers two entry points:

• playwright.sync_api – Simple, blocking calls, perfect for quick scripts.
• playwright.async_api – Non‑blocking, ideal for high‑throughput scenarios.

Below is a minimal synchronous example that navigates to example.com and captures a screenshot.

from playwright.sync_api import sync_playwright

def run():
    with sync_playwright() as p:
        # Launch Chromium in headless mode
        browser = p.chromium.launch(headless=True)
        page = browser.new_page()
        page.goto("https://example.com")
        page.screenshot(path="example.png")
        browser.close()

if __name__ == "__main__":
    run()

To convert the same script to async, replace the import and add await keywords:

import asyncio
from playwright.async_api import async_playwright

async def run():
    async with async_playwright() as p:
        browser = await p.chromium.launch(headless=True)
        page = await browser.new_page()
        await page.goto("https://example.com")
        await page.screenshot(path="example.png")
        await browser.close()

asyncio.run(run())

Core Playwright Concepts Every Python Developer Should Master

1. Selectors and Locator Strategies

Playwright supports CSS, XPath, text, and role‑based selectors. The Locator object is lazy and automatically retries until the element meets the required state.

# CSS selector
login_button = page.locator("button#login")

# Text selector (case‑insensitive)
welcome_msg = page.locator("text=Welcome")

# Role selector (ARIA)
submit = page.get_by_role("button", name="Submit")

2. Auto‑Waiting and Assertions

Instead of manually waiting for network idle or element visibility, use built‑in assertions that also act as waits.

# Wait until the element is visible and enabled
login_button.wait_for(state="visible")
login_button.click()

# Assertion that also waits
page.get_by_role("heading", name="Dashboard").to_be_visible()

3. Network Interception and Mocking

Testing edge cases is easy with request routing. Below we mock an API response:

def handle_route(route, request):
    if "api/users" in request.url:
        route.fulfill(
            status=200,
            content_type="application/json",
            body='{"users": []}'
        )
    else:
        route.continue_()

page.route("**/*", handle_route)

4. Screenshots, Videos, and Tracing

Capture visual evidence for debugging or documentation:

• Screenshot: page.screenshot(path="step.png")
• Video: Enable when launching the browser: browser.new_context(record_video_dir="videos/")
• Trace: Start/stop tracing to generate a HAR‑like report.

await context.tracing.start(screenshots=True, snapshots=True)
# …run test steps…
await context.tracing.stop(path="trace.zip")

Integrating Playwright with Pytest for Scalable Test Suites

Most teams combine Playwright with pytest to benefit from fixtures, parallel execution, and rich reporting.

# conftest.py
import pytest
from playwright.sync_api import sync_playwright

@pytest.fixture(scope="session")
def browser():
    with sync_playwright() as p:
        browser = p.chromium.launch(headless=False)
        yield browser
        browser.close()

@pytest.fixture
def page(browser):
    context = browser.new_context()
    page = context.new_page()
    yield page
    context.close()

Now a test file can simply import the page fixture:

# test_login.py
def test_successful_login(page):
    page.goto("https://example.com/login")
    page.fill("input[name='username']", "admin")
    page.fill("input[name='password']", "secret")
    page.click("button[type='submit']")
    page.get_by_role("heading", name="Dashboard").to_be_visible()

Best Practices for Reliable Python Playwright Automation

• Prefer locators over raw selectors. Locators are auto‑retrying and reduce flaky failures.
• Use explicit assertions. They double as waits and make test intent clear.
• Keep browsers isolated. Create a new context per test to avoid state leakage.
• Leverage built‑in tracing. Store traces for CI failures to speed up debugging.
• Run headless in CI, headed locally. This gives you visual feedback during development.
• Version‑pin browsers. Use playwright install chromium@1234 to lock down the exact binary.

Common Pitfalls and How to Avoid Them

1. Ignoring Async Event Loops

If you mix synchronous and asynchronous code, you’ll encounter RuntimeError: Event loop is closed. Stick to one paradigm per module, or use anyio.run() to bridge.

2. Over‑using time.sleep()

Hard‑coded sleeps defeat Playwright’s auto‑waiting and dramatically increase test runtime. Replace them with await page.wait_for_selector() or assertions.

3. Not Cleaning Up Contexts

Leaking browser contexts consumes memory and can cause intermittent failures. Always close contexts in a finally block or via fixtures.

4. Forgetting to Set headless=False During Debugging

Running headless hides UI clues. Toggle the flag when troubleshooting UI layout issues.

SEO‑Friendly Keywords to Remember

When publishing your Playwright tutorials or blog posts, sprinkle these high‑traffic terms naturally throughout the content:

• Python Playwright tutorial
• Playwright web automation
• headless browser Python
• Playwright vs Selenium
• Playwright async example
• Playwright tracing and debugging
• Playwright pytest integration

Conclusion

Python Playwright has transformed the way developers approach web automation—offering speed, reliability, and a unified API across all major browsers. By mastering the installation steps, core concepts like locators and auto‑waiting, and integrating with testing frameworks such as pytest, you can build robust automation suites that scale from simple data‑scraping scripts to enterprise‑grade UI test pipelines. Remember to follow

Imagine a web dashboard that updates instantly the moment a sensor records a new temperature, or a live sports scoreboard that never misses a goal. With Python Server-Sent Events (SSE), you can deliver real‑time, one‑way data streams to browsers without the overhead of full‑duplex WebSockets. In this guide we’ll explore how SSE works, why it’s a solid choice for many Python web apps, and walk through step‑by‑step implementations using Flask, Django, and asyncio. By the end, you’ll have a production‑ready SSE endpoint, best‑practice tips, and a checklist to keep your app fast, reliable, and SEO‑friendly.

What Are Server‑Sent Events?

Server‑Sent Events are part of the HTML5 EventSource API. Unlike WebSockets, which create a bidirectional channel, SSE opens a single, long‑lived HTTP connection where the server pushes text‑based events to the client. The browser automatically reconnects if the connection drops, and each event can carry an optional ID for reliable delivery.

• Simple protocol: plain text with minimal headers.
• Built‑in reconnection: the EventSource object retries automatically.
• Lightweight: no binary framing or handshake overhead.
• SEO‑friendly: because the initial page load is a normal HTTP response, search engines can index your content.

Why Choose SSE Over WebSockets?

Both SSE and WebSockets enable real‑time communication, but each shines in different scenarios. Use SSE when you need:

1. Unidirectional updates: server → client only (e.g., live feeds, notifications).
2. Compatibility with HTTP/2: SSE works over standard HTTP/2 streams without extra configuration.
3. Ease of deployment: no special ports or protocols; works behind most proxies and CDNs.
4. Graceful fallback: browsers that don’t support WebSockets still handle EventSource well.

If your app requires client‑to‑server messages (chat, collaborative editing), WebSockets remain the better choice. For most monitoring dashboards, news tickers, or IoT telemetry, SSE offers a cleaner, lower‑maintenance solution.

Setting Up a Basic SSE Endpoint with Flask

Flask’s lightweight nature makes it ideal for a quick SSE prototype. Below is a minimal example that streams the current server time every second.

from flask import Flask, Response, stream_with_context
import time

app = Flask(__name__)

def event_stream():
    """Yield a new SSE formatted message every second."""
    while True:
        # The 'data' field is required by the SSE spec
        yield f"data: The time is {time.strftime('%Y-%m-%d %H:%M:%S')}\n\n"
        time.sleep(1)

@app.route('/time')
def sse_time():
    # Set the correct MIME type for SSE
    return Response(
        stream_with_context(event_stream()),
        mimetype='text/event-stream',
        headers={'Cache-Control': 'no-cache'}
    )

if __name__ == '__main__':
    app.run(threaded=True, debug=True)

Key points to note:

• Use text/event-stream as the MIME type.
• Yield a double newline (\n\n) after each event.
• Wrap the generator with stream_with_context to preserve Flask’s request context.

Client‑Side JavaScript

On the browser side, the EventSource object handles everything for you.

const source = new EventSource('/time');

source.onmessage = function(event) {
    console.log('Server says:', event.data);
    document.getElementById('clock').textContent = event.data;
};

source.onerror = function(err) {
    console.error('SSE error:', err);
};

Handling SSE in Django

Django’s request/response cycle is synchronous by default, but you can still serve SSE using StreamingHttpResponse. For larger projects, consider Django Channels if you need both SSE and WebSocket support.

# views.py
import time
from django.http import StreamingHttpResponse

def sse_generator():
    while True:
        yield f"data: Server tick at {time.time():.0f}\\n\\n"
        time.sleep(2)

def sse_view(request):
    response = StreamingHttpResponse(
        sse_generator(),
        content_type='text/event-stream'
    )
    response['Cache-Control'] = 'no-cache'
    return response

Don’t forget to add the route in urls.py:

from django.urls import path
from . import views

urlpatterns = [
    path('ticks/', views.sse_view, name='sse-ticks'),
]

Running Django with Gunicorn

When deploying, use a WSGI server that supports streaming responses, such as gunicorn with the gevent worker class:

gunicorn myproject.wsgi:application -k gevent -b 0.0.0.0:8000

Using AsyncIO for High‑Performance SSE

For high‑throughput scenarios—think thousands of concurrent connections—asyncio and an ASGI server (e.g., uvicorn, hypercorn) deliver superior scalability.

FastAPI Example

from fastapi import FastAPI, Request
from fastapi.responses import StreamingResponse
import asyncio
import datetime

app = FastAPI()

async def async_event_generator():
    while True:
        now = datetime.datetime.utcnow().isoformat()
        yield f"data: {{\"time\": \"{now}\"}}\n\n"
        await asyncio.sleep(1)

@app.get("/stream")
async def sse_endpoint(request: Request):
    # Close the stream if the client disconnects
    async def event_stream():
        async for event in async_event_generator():
            if await request.is_disconnected():
                break
            yield event

    return StreamingResponse(event_stream(),
                             media_type="text/event-stream")

Running the app with uvicorn:

uvicorn main:app --host 0.0.0.0 --port 8000 --workers 4

Best Practices and Common Pitfalls

• Set proper headers: Cache-Control: no-cache prevents intermediate proxies from buffering the stream.
• Send a comment line every 15‑30 seconds: : keep‑alive keeps some reverse proxies from timing out.
• Limit event size: browsers may truncate events larger than 64 KB; split large payloads into multiple messages.
• Graceful shutdown: catch termination signals and close generators to avoid broken pipes.
• Security: validate any query parameters used to filter streams; never expose raw database cursors directly.

Example Keep‑Alive Comment

def keep_alive():
    while True:
        yield ": keep-alive\\n\\n"
        time.sleep(20)

Combine this with your data generator using itertools.chain or an async asyncio.gather to keep the connection alive even during idle periods.

Testing and Debugging SSE

Because SSE relies on a persistent HTTP connection, traditional request/response debugging tools may not capture the stream. Use these techniques:

1. cURL: curl -N http://localhost:5000/time shows raw events in the terminal.
2. Browser DevTools: Network tab → select the SSE request → view “Event Stream” to see parsed events.
3. Unit tests: mock the generator function and assert that each yielded string matches the SSE format.
4. Load testing: tools like k6 or locust can simulate thousands of concurrent EventSource connections.

SEO Considerations for SSE‑Powered Pages

Search engines index the initial HTML response, not the live data pushed via SSE. To keep your page SEO‑friendly:

• Render critical content server‑side before establishing the SSE connection.
• Use noscript tags to provide fallback static information for crawlers.
• Leverage structured data (JSON‑LD) in the initial HTML to describe the page’s purpose.
• Ensure the URL of the SSE endpoint is not indexed (add robots.txt rules or X-Robots-Tag: noindex header).

Conclusion

Python Server‑Sent Events give developers a straightforward, standards‑based way to push real‑time updates to browsers without the complexity of WebSockets. Whether you’re building a lightweight Flask dashboard, a robust Django monitoring tool, or a

Developing web applications with Python is a breeze, but when you need to test HTTPS locally, the process can feel a bit daunting. In this guide we’ll walk you through a step‑by‑step Python HTTPS local development setup that works with popular frameworks like Flask and Django, covers self‑signed certificates, and even shows how to integrate tools such as mkcert and ngrok. By the end of this post you’ll have a secure, repeatable environment that mirrors production, boosts your confidence, and improves SEO‑friendly testing.

Why Use HTTPS in Local Development?

Running your app over HTTPS locally isn’t just a nicety; it’s a best practice that brings several tangible benefits:

• Accurate browser behavior: Modern browsers block mixed content, so testing with HTTP can hide bugs that only appear under HTTPS.
• OAuth and third‑party APIs: Many services (Google, Stripe, etc.) require a secure redirect URI, making a local HTTPS endpoint essential.
• Security‑first mindset: Early exposure to TLS configuration reduces the risk of misconfigurations when you go live.
• SEO testing: Search engines treat HTTPS as a ranking signal; testing locally helps catch canonical URL issues early.

Prerequisites

Before diving in, make sure you have the following installed on your development machine:

1. Python 3.9+ (python --version)
2. pip or pipenv for package management
3. OpenSSL (usually pre‑installed on macOS and Linux; Windows users can get it via Win32 OpenSSL)
4. A code editor of your choice (VS Code, PyCharm, etc.)

Generating a Self‑Signed Certificate

The simplest way to enable HTTPS is to create a self‑signed certificate. While browsers will show a warning, you can add an exception for development purposes.

Step‑by‑step with OpenSSL

# Create a private key
openssl genrsa -out dev.key 2048

# Generate a certificate signing request (CSR)
openssl req -new -key dev.key -out dev.csr \
  -subj "/C=US/ST=California/L=SanFrancisco/O=MyCompany/OU=Dev/CN=localhost"

# Sign the certificate (valid for 365 days)
openssl x509 -req -days 365 -in dev.csr -signkey dev.key -out dev.crt

After running these commands you’ll have dev.key (the private key) and dev.crt (the certificate) in your project folder.

Using mkcert for Browser‑Trusted Certs

If you’d rather avoid browser warnings, mkcert creates certificates that are trusted by your local machine out of the box.

# Install mkcert (macOS example)
brew install mkcert
brew install nss # for Firefox support

# Create a local CA (once)
mkcert -install

# Generate a cert for localhost
mkcert localhost 127.0.0.1 ::1

This command produces localhost+2.pem (certificate) and localhost+2-key.pem (key) which can be used directly in Python servers.

Integrating HTTPS with Flask

Flask’s built‑in development server can serve HTTPS with a single line of code. Below is a minimal example using the self‑signed cert we created earlier.

from flask import Flask

app = Flask(__name__)

@app.route('/')
def hello():
    return "🔒 Secure Flask app running on HTTPS!"

if __name__ == '__main__':
    # Pass the certificate and key files to the run() method
    app.run(host='127.0.0.1', port=5000, ssl_context=('dev.crt', 'dev.key'))

Run the script with python app.py and open https://localhost:5000. Remember to accept the security exception if you used a self‑signed cert.

Hot‑Reload with HTTPS

Flask’s debug=True flag enables auto‑reloading, but you need to pass the SSL context as a tuple. Here’s a developer‑friendly version:

app.run(
    host='0.0.0.0',
    port=8443,
    debug=True,
    ssl_context=('dev.crt', 'dev.key')
)

Now you can edit your code and see changes instantly while staying under HTTPS.

Configuring HTTPS in Django

Django’s development server does not natively support HTTPS, but you can wrap it with runsslserver or use uvicorn for ASGI projects.

Option 1: Using django-sslserver

# Install the package
pip install django-sslserver

# Add to INSTALLED_APPS in settings.py
INSTALLED_APPS = [
    # …
    'sslserver',
]

# Run the HTTPS server
python manage.py runsslserver 0.0.0.0:8000 \
    --certificate dev.crt --key dev.key

This command starts Django on https://localhost:8000 with your custom certificate.

Option 2: Using uvicorn for Django Channels or ASGI

# Install uvicorn
pip install uvicorn

# Run with SSL
uvicorn myproject.asgi:application \
    --host 0.0.0.0 --port 8443 \
    --ssl-keyfile dev.key --ssl-certfile dev.crt

Both approaches let you test middleware, security headers, and CSP policies exactly as they will behave in production.

Automating Certificate Generation with a Makefile

To keep your workflow smooth, add a simple Makefile (or a scripts folder) that regenerates certificates whenever needed.

.PHONY: cert clean

cert:
    @echo "Generating a fresh self‑signed certificate..."
    openssl req -x509 -nodes -days 365 \
        -newkey rsa:2048 \
        -keyout dev.key -out dev.crt \
        -subj "/CN=localhost"

clean:
    rm -f dev.key dev.crt dev.csr

Now you can run make cert before starting your server, ensuring the cert is always up‑to‑date.

Testing HTTPS with Automated Tools

Once your local server runs over HTTPS, you can integrate it with testing suites:

• pytest‑httpx: Use httpx.AsyncClient with verify=False for quick unit tests.
• Selenium / Playwright: Launch browsers with --ignore-certificate-errors to automate UI tests.
• curl: Simple command‑line verification: curl -k https://localhost:5000

Example pytest fixture

import pytest
import httpx

@pytest.fixture
def client():
    return httpx.Client(base_url="https://localhost:5000", verify=False)

def test_homepage(client):
    response = client.get("/")
    assert response.status_code == 200
    assert "Secure Flask app" in response.text

This fixture works for both Flask and Django projects, giving you confidence that your HTTPS routes behave correctly.

Sharing Your Local HTTPS Server with the World (Optional)

Sometimes you need to demo a feature to a remote stakeholder. Tools like ngrok expose a secure tunnel to your local HTTPS server without extra configuration.

# Install ngrok (example)
brew install ngrok

# Start a tunnel to your local Flask server
ngrok http 5000

# ngrok will output a public HTTPS URL like:
# https://abcd1234.ngrok.io

The tunnel inherits TLS from ngrok, so you don’t need to worry about certificate warnings on the remote side.

Best Practices for a Secure Local Environment

• Never commit private keys: Add *.key and *.crt to .gitignore.
• Rotate certificates regularly: Even in dev, short‑lived certs reduce the risk of accidental exposure.
• Use environment variables: Store paths to your certs in .env and load them with python-dotenv.
• Enable HSTS in dev (optional): Add Strict-Transport-Security header to test caching behavior.
• Run linting and security scans: Tools like bandit can flag insecure TLS configurations.

Full

In the fast‑moving world of Python web development, building a feature‑rich application is only half the battle—protecting it from ever‑evolving threats is the other. Whether you’re using Django, Flask, FastAPI, or any other framework, following proven security best practices can mean the difference between a trusted service and a costly breach. This guide walks you through the essential steps to harden your Python web apps, from input validation to continuous monitoring, so you can ship code with confidence.

Why Python Web Security Matters

Python’s popularity among developers stems from its readability, extensive libraries, and rapid development cycle. However, these advantages can also introduce vulnerabilities when developers overlook security fundamentals. Attackers often target common weaknesses such as insecure authentication, improper input handling, and misconfigured servers. By integrating security into every layer of your stack, you protect user data, maintain compliance, and preserve your brand’s reputation.

Core Security Pillars for Python Web Applications

1. Input Validation & Sanitization

Never trust data that comes from the client. Proper validation stops malicious payloads before they reach your business logic.

• Whitelist over blacklist: Define exactly what characters, formats, and lengths are allowed.
• Use built‑in validators: Django’s forms and ModelSerializer in DRF provide automatic sanitization.
• Escape output: When rendering user‑generated content, always escape HTML using django.utils.html.escape or Jinja2’s auto‑escaping.

2. Authentication & Authorization

Strong authentication mechanisms and granular authorization checks are non‑negotiable.

1. Prefer built‑in solutions: Django’s django.contrib.auth and Flask‑Login are battle‑tested.
2. Enforce multi‑factor authentication (MFA): Integrate with providers like Authy or Google Authenticator.
3. Use secure password hashing: argon2 or bcrypt via passlib are recommended over legacy MD5/SHA1.
4. Implement role‑based access control (RBAC): Define permissions at the model or view level, and never rely on “hidden” UI elements for security.

3. Secure Session Management

Sessions keep users logged in, but misconfiguration can expose session IDs to attackers.

• Use server‑side sessions: Django’s signed cookies or Flask’s SecureCookieSessionInterface with SESSION_COOKIE_HTTPONLY=True.
• Set Secure and SameSite flags: Prevents transmission over HTTP and mitigates CSRF.
• Rotate session IDs: Regenerate the session ID after login and privilege changes.

4. Protecting Against Common Web Attacks

OWASP’s Top 10 remains a reliable checklist for developers.

Cross‑Site Scripting (XSS)

Never inject raw user input into HTML, JavaScript, or CSS.

# Bad practice – directly concatenating user input
response = f"<div>{user_input}</div>"

# Good practice – using template auto‑escaping
return render_template("page.html", comment=user_input)

Cross‑Site Request Forgery (CSRF)

• Enable CSRF protection middleware (e.g., django.middleware.csrf.CsrfViewMiddleware).
• Include {% csrf_token %} in every POST form.
• For APIs, require a custom header like X‑CSRF‑Token or use SameSite cookies.

SQL Injection

Never build queries by concatenating strings.

# Vulnerable
cursor.execute(f"SELECT * FROM users WHERE email = '{email}'")

# Safe – parameterized query
cursor.execute("SELECT * FROM users WHERE email = %s", (email,))

Insecure Deserialization

Avoid using pickle for data received from untrusted sources. Prefer JSON or safe libraries like itsdangerous.

Security Headers: The First Line of Defense

HTTP security headers instruct browsers on how to handle content, reducing the attack surface.

• Content‑Security‑Policy (CSP): Restricts sources for scripts, styles, and media.
• X‑Content‑Type‑Options: nosniff – Prevents MIME‑type sniffing.
• Strict‑Transport‑Security (HSTS): Forces HTTPS connections.
• Referrer‑Policy: Controls how much referrer information is sent.
• X‑Frame‑Options: DENY – Stops clickjacking.

Most frameworks let you set these headers globally; for Django, use SecurityMiddleware, and for Flask, add them in a before_request handler.

Dependency Management & Patch Management

Third‑party packages are a common source of vulnerabilities. Stay ahead with these practices:

1. Pin exact versions: Use requirements.txt with == to avoid accidental upgrades.
2. Automate vulnerability scanning: Tools like safety, bandit, and GitHub Dependabot flag known CVEs.
3. Prefer maintained libraries: Check the project’s release cadence and community activity before adding it.
4. Isolate environments: Virtualenv or Poetry ensures each app runs with its own dependency set.

Secure Configuration & Secrets Management

Hard‑coding secrets is a recipe for disaster. Adopt a systematic approach:

• Environment variables: Store API keys, database passwords, and secret keys outside the codebase.
• Use a secrets vault: HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault provide encryption at rest and fine‑grained access control.
• Disable debug mode in production: Django’s DEBUG=False and Flask’s app.config["ENV"] = "production" prevent sensitive data leakage.
• Set strict file permissions: Ensure config files are readable only by the application user.

Logging, Monitoring, and Incident Response

Even the best‑hardened apps can be probed. Robust logging helps you detect and respond quickly.

1. Log security‑relevant events: Failed logins, permission changes, and admin actions.
2. Use structured logging: JSON format works well with log aggregation tools like ELK or Splunk.
3. Mask sensitive data: Never log raw passwords, credit‑card numbers, or full JWTs.
4. Set up alerts: Trigger notifications on abnormal patterns (e.g., many 404s from a single IP).
5. Plan an incident response playbook: Define roles, communication channels, and steps for containment and remediation.

Testing & Continuous Integration (CI) for Security

Security isn’t a one‑time checklist; embed it into your development pipeline.

• Static analysis: Run bandit or pylint on every pull request.
• Dynamic testing: Use OWASP ZAP or Burp Suite to scan running instances.
• Dependency checks: Integrate safety and Dependabot into CI pipelines.
• Fuzz testing: Tools like afl or hypothesis can uncover edge‑case bugs.

Automating these checks ensures that security regressions are caught early, reducing remediation costs.

Best Practices Summary

• Validate and escape all user input.
• Leverage framework‑provided authentication, and enforce MFA.
• Secure sessions with HttpOnly, Secure, and SameSite flags.
• Implement CSP, HSTS, and other security headers.
• Keep dependencies up‑to‑date and scan for known vulnerabilities.

<

In today’s security‑first landscape, relying on a single password is no longer enough to protect your Python applications. Multi‑factor authentication (MFA) adds an extra layer of defense by requiring users to prove their identity with something they know, something they have, or even something they are. This guide walks you through the fundamentals of MFA, why it matters for Python developers, and provides step‑by‑step code examples for integrating TOTP‑based MFA into popular frameworks like Flask and Django.

What Is Multi‑Factor Authentication and Why It Matters

Multi‑factor authentication combines two or more independent credentials to verify a user’s identity. The most common factors are:

• Knowledge: a password or PIN.
• Possession: a smartphone app (Google Authenticator, Authy), a hardware token, or an SMS code.
• Inherence: biometric data such as fingerprints or facial recognition.

Implementing MFA dramatically reduces the risk of credential stuffing, phishing, and brute‑force attacks. According to a Verizon Data Breach Investigation Report, breaches involving compromised passwords drop by up to 99% when MFA is enforced.

Choosing the Right MFA Method for Python Projects

Python developers have several options when it comes to MFA. The most widely adopted approach for web applications is Time‑Based One‑Time Passwords (TOTP), which are generated by standard authenticator apps and follow the RFC 6238 specification. TOTP is:

• Open‑source and free.
• Supported across Android, iOS, and desktop platforms.
• Easy to implement with libraries like pyotp and django-otp.

If you need a higher assurance level, consider integrating FIDO2/WebAuthn for hardware keys, or using third‑party services such as Auth0, Okta, or Duo Security. This article focuses on TOTP because it strikes a balance between security, user experience, and implementation effort.

Setting Up a Basic TOTP MFA Flow in Python

Prerequisites

1. Python 3.8+ installed.
2. A virtual environment (recommended).
3. Basic familiarity with Flask or Django.
4. Install required packages:

   pip install pyotp qrcode[pil] pillow

Generating a Secret and QR Code

The secret key is a base‑32 string stored securely for each user. It can be displayed as a QR code that authenticator apps scan.

import pyotp
import qrcode
from io import BytesIO
import base64

def generate_mfa_secret(username: str) -> str:
    # Create a unique secret per user
    secret = pyotp.random_base32()
    # Store `secret` in your user database (hashed or encrypted)
    return secret

def get_qr_code_uri(secret: str, username: str, issuer: str = "MyApp"):
    # Build the provisioning URI (compatible with Google Authenticator)
    totp = pyotp.TOTP(secret)
    return totp.provisioning_uri(name=username, issuer_name=issuer)

def qr_code_image(uri: str) -> str:
    # Generate PNG image and encode as base64 for embedding in HTML
    img = qrcode.make(uri)
    buffer = BytesIO()
    img.save(buffer, format="PNG")
    return "data:image/png;base64," + base64.b64encode(buffer.getvalue()).decode()

Verifying a User‑Submitted Token

When a user logs in and provides the 6‑digit code from their authenticator app, you validate it against the stored secret.

def verify_mfa_token(secret: str, token: str) -> bool:
    totp = pyotp.TOTP(secret)
    # `verify` accepts a window of ±1 step (30 seconds) to tolerate clock drift
    return totp.verify(token, valid_window=1)

Integrating MFA into a Flask Application

Project Structure

.
├─ app.py
├─ models.py   # simple user model with `mfa_secret`
├─ templates/
│   ├─ login.html
│   ├─ mfa_setup.html
│   └─ mfa_verify.html
└─ requirements.txt

Key Flask Routes

from flask import Flask, render_template, request, redirect, session, url_for, flash
from models import User, db_session
import pyotp, qrcode, base64, io

app = Flask(__name__)
app.secret_key = "super‑secret‑key"

@app.route("/login", methods=["GET", "POST"])
def login():
    if request.method == "POST":
        user = User.query.filter_by(username=request.form["username"]).first()
        if user and user.check_password(request.form["password"]):
            session["user_id"] = user.id
            if user.mfa_secret:
                return redirect(url_for("mfa_verify"))
            else:
                return redirect(url_for("mfa_setup"))
        flash("Invalid credentials")
    return render_template("login.html")

@app.route("/mfa/setup", methods=["GET", "POST"])
def mfa_setup():
    user = User.query.get(session["user_id"])
    if request.method == "POST":
        token = request.form["token"]
        if verify_mfa_token(user.mfa_secret, token):
            flash("MFA enabled successfully")
            return redirect(url_for("dashboard"))
        flash("Invalid token")
    else:
        # First time: generate secret and QR code
        if not user.mfa_secret:
            user.mfa_secret = generate_mfa_secret(user.username)
            db_session.commit()
        uri = get_qr_code_uri(user.mfa_secret, user.username)
        qr_data = qr_code_image(uri)
        return render_template("mfa_setup.html", qr_data=qr_data)

@app.route("/mfa/verify", methods=["GET", "POST"])
def mfa_verify():
    user = User.query.get(session["user_id"])
    if request.method == "POST":
        token = request.form["token"]
        if verify_mfa_token(user.mfa_secret, token):
            session["mfa_verified"] = True
            return redirect(url_for("dashboard"))
        flash("Invalid token")
    return render_template("mfa_verify.html")

Template Snippet for QR Code Display

<!-- mfa_setup.html -->
<h2>Set Up Multi‑Factor Authentication</h2>
<p>Scan the QR code below with Google Authenticator, Authy, or any TOTP app.</p>
<img src="{{ qr_data }}" alt="MFA QR Code" />
<form method="post">
    <label for="token">Enter the 6‑digit code:</label>
    <input type="text" name="token" id="token" required />
    <button type="submit">Verify</button>
</form>

Adding MFA to a Django Project

Leverage django-otp and django-two-factor-auth

Both packages provide ready‑made views, models, and middleware. Install them with:

pip install django-otp django-two-factor-auth

Configuration Steps

1. Add the apps to INSTALLED_APPS:

   INSTALLED_APPS = [
       ...,
       'django_otp',
       'django_otp.plugins.otp_totp',
       'two_factor',
       'two_factor.plugins.phonenumber',
   ]

2. Insert the OTP middleware before authentication middleware:

   MIDDLEWARE = [
       'django_otp.middleware.OTPMiddleware',
       ...,
       'django.contrib.auth.middleware.AuthenticationMiddleware',
       ...,
   ]

3. Update urls.py to include the two‑factor URLs:

   from django.urls import path, include
   urlpatterns = [
       path('', include('two_factor.urls', 'two_factor')),
       # other app URLs
   ]

4. Run migrations:

   python manage.py migrate

Customizing the Login Flow

If you already have a bespoke login view, you can wrap it with LoginView from two_factor.views:

from two_factor.views import LoginView

class MyLoginView(LoginView):
    template_name = 'myapp/login.html'
    # You can override form_class, success_url, etc.

Best Practices for Secure MFA Implementation

• Store secrets encrypted. Never keep the TOTP secret in plain text; use a server‑side encryption key or a vault service.
• Enforce backup codes. Provide users with a set of one‑time use backup codes for situations where their authenticator device is unavailable.
• Rate‑limit verification attempts. Limit failed MFA attempts to mitigate brute‑force attacks.
• Use HTTPS everywhere. MFA tokens are sensitive; TLS protects them from eavesdropping.
• Educate users. Explain why MFA is required and give clear instructions for setup.
• Log MFA events. Record successful and failed MFA challenges for audit trails.

Testing Your MFA Setup

Automated tests should cover both happy‑path and edge cases. Below is a pytest example

Welcome to this step‑by‑step Python password reset via email tutorial. Whether you’re building a small Flask app or a full‑featured Django site, offering a secure, user‑friendly password reset flow is essential for both user satisfaction and security compliance. In this guide you’ll learn how to generate a one‑time token, send a reset link through email, and safely update the user’s password—all with clean, reusable Python code.

Why a Password‑Reset Feature Matters

Users forget passwords, and a robust password reset via email is the most common recovery method. Implementing it correctly protects against:

• Credential stuffing attacks.
• Unauthorized account access.
• Compliance violations (GDPR, CCPA, etc.).

By following this tutorial you’ll avoid common pitfalls such as plain‑text token storage, insecure link handling, and email spoofing.

Prerequisites

Before diving into code, make sure you have the following ready:

• Python 3.9+ installed.
• A virtual environment (recommended venv or conda).
• Basic knowledge of Flask or Django (the tutorial covers both).
• Access to an SMTP server (Gmail, SendGrid, Mailgun, etc.).

Project Setup

1. Create a new virtual environment

python -m venv venv
source venv/bin/activate   # Linux/macOS
venv\Scripts\activate      # Windows

2. Install required packages

We’ll use Flask for the lightweight example and itsdangerous for token generation. For Django, the same token library works out of the box.

pip install Flask itsdangerous Flask-Mail
# For Django users:
pip install Django

Configuring the Email Backend

Both Flask and Django need SMTP credentials. Store them securely in environment variables to keep them out of source control.

# .env (example)
MAIL_SERVER=smtp.gmail.com
MAIL_PORT=587
MAIL_USE_TLS=True
MAIL_USERNAME=your.email@gmail.com
MAIL_PASSWORD=your_app_password
SECRET_KEY=super‑secret‑key‑for‑tokens

Load these variables in your app using python-dotenv or the OS module.

Generating a Secure Token

The core of a Python password reset via email tutorial is a time‑limited token that can be verified later. itsdangerous.URLSafeTimedSerializer provides exactly that.

from itsdangerous import URLSafeTimedSerializer
import os

def get_serializer():
    secret_key = os.getenv('SECRET_KEY')
    return URLSafeTimedSerializer(secret_key)

def generate_reset_token(email):
    s = get_serializer()
    return s.dumps(email, salt='password-reset-salt')

def verify_reset_token(token, max_age=3600):
    s = get_serializer()
    try:
        email = s.loads(token, salt='password-reset-salt', max_age=max_age)
    except Exception:
        return None
    return email

Flask Implementation

Application Skeleton

from flask import Flask, render_template, request, redirect, url_for, flash
from flask_mail import Mail, Message
import os

app = Flask(__name__)
app.config.update(
    SECRET_KEY=os.getenv('SECRET_KEY'),
    MAIL_SERVER=os.getenv('MAIL_SERVER'),
    MAIL_PORT=int(os.getenv('MAIL_PORT')),
    MAIL_USE_TLS=os.getenv('MAIL_USE_TLS') == 'True',
    MAIL_USERNAME=os.getenv('MAIL_USERNAME'),
    MAIL_PASSWORD=os.getenv('MAIL_PASSWORD')
)

mail = Mail(app)

Reset Request View

This endpoint accepts an email address, creates a token, and sends the reset link.

@app.route('/reset-password', methods=['GET', 'POST'])
def reset_request():
    if request.method == 'POST':
        email = request.form['email']
        # TODO: Verify email exists in your DB
        token = generate_reset_token(email)
        reset_url = url_for('reset_token', token=token, _external=True)
        msg = Message('Password Reset Request',
                      sender=app.config['MAIL_USERNAME'],
                      recipients=[email])
        msg.body = f'''Hi,

We received a request to reset your password. Click the link below to choose a new password:

{reset_url}

If you didn’t request this, simply ignore this email.
'''
        mail.send(msg)
        flash('A password reset link has been sent to your email.', 'info')
        return redirect(url_for('login'))
    return render_template('reset_request.html')

Reset Token View

The user lands on this page after clicking the link. We verify the token and allow a new password to be set.

@app.route('/reset-password/<token>', methods=['GET', 'POST'])
def reset_token(token):
    email = verify_reset_token(token)
    if not email:
        flash('The reset link is invalid or has expired.', 'danger')
        return redirect(url_for('reset_request'))

    if request.method == 'POST':
        new_password = request.form['password']
        # TODO: Hash the password and update the user record
        flash('Your password has been updated!', 'success')
        return redirect(url_for('login'))

    return render_template('reset_token.html', token=token)

Django Implementation

If you prefer Django, the built‑in PasswordResetView handles most of the heavy lifting. Below is a minimal setup that still follows the same token logic.

urls.py

from django.urls import path
from . import views

urlpatterns = [
    path('reset/', views.PasswordResetRequestView.as_view(), name='password_reset'),
    path('reset///', views.PasswordResetConfirmView.as_view(), name='password_reset_confirm'),
]

views.py

from django.contrib.auth.tokens import default_token_generator
from django.contrib.auth.models import User
from django.core.mail import send_mail
from django.shortcuts import render, redirect
from django.utils.http import urlsafe_base64_encode, urlsafe_base64_decode
from django.utils.encoding import force_bytes, force_str
from django.views import View
import os

class PasswordResetRequestView(View):
    def get(self, request):
        return render(request, 'password_reset_form.html')

    def post(self, request):
        email = request.POST['email']
        try:
            user = User.objects.get(email=email)
        except User.DoesNotExist:
            # For security, don’t reveal if the email exists
            pass
        else:
            token = default_token_generator.make_token(user)
            uid = urlsafe_base64_encode(force_bytes(user.pk))
            reset_link = request.build_absolute_uri(
                f'/reset/{uid}/{token}/')
            send_mail(
                subject='Password Reset',
                message=f'Click the link to reset your password: {reset_link}',
                from_email=os.getenv('MAIL_USERNAME'),
                recipient_list=[email],
            )
        return redirect('login')

Confirm View

class PasswordResetConfirmView(View):
    def get(self, request, uidb64, token):
        try:
            uid = force_str(urlsafe_base64_decode(uidb64))
            user = User.objects.get(pk=uid)
        except (User.DoesNotExist, ValueError, TypeError):
            user = None

        if user and default_token_generator.check_token(user, token):
            return render(request, 'password_reset_confirm.html', {'validlink': True, 'uidb64': uidb64, 'token': token})
        else:
            return render(request, 'password_reset_confirm.html', {'validlink': False})

    def post(self, request, uidb64, token):
        # Same validation as GET
        # Update password
        new_password = request.POST['password']
        user.set_password(new_password)
        user.save()
        return redirect('login')

Security Best Practices

• Never store plain‑text passwords. Always hash with bcrypt or argon2.
• Limit token lifetime (commonly 1 hour) using the max_age argument.
• Rate‑limit reset requests to prevent enumeration attacks.
• Use HTTPS for every endpoint that handles tokens or passwords.
• Include a short, random nonce in the email body to thwart replay attacks.

Testing the Flow

Before deploying, run through these checks:

1. Submit a valid email – verify you receive a correctly formatted reset link.
2. Click the link after the token expires – ensure the user sees an expiration message.
3. Attempt to reuse a token – it should be invalid after the first successful password change.
4. Submit a weak password – enforce your password policy and return clear error messages.

Deploying to Production

When you push your code live, remember to:

• Set MAIL_USE_TLS=True or MAIL_USE_SSL=True depending on your provider.
• Configure a dedicated email domain (e.g., no-reply@yourdomain.com) to improve deliverability.
• Enable SPF, DKIM, and DMARC records for your sending domain.
• Monitor bounce rates and implement a fallback email service if needed.

Conclusion

Implementing a secure Python password reset via email tutorial doesn’t have to be daunting. By leveraging itsdangerous for token handling, configuring a reliable SMTP backend, and

When you want to let users log in to your Python web app with their GitHub accounts, the OAuth 2.0 authentication flow is the industry‑standard solution. In this guide we walk through every step of the Python GitHub OAuth authentication flow, from registering your app on GitHub to handling callbacks, exchanging tokens, and securely calling the GitHub API. Whether you are building a Flask micro‑service, a Django portal, or a simple script, the concepts and code snippets below will give you a solid, SEO‑friendly foundation.

Why Choose GitHub OAuth for Python Projects?

• Trusted identity provider: Millions of developers already have GitHub accounts.
• Fine‑grained scopes: Request only the permissions you need (e.g., read:user, repo).
• Easy integration: GitHub follows the standard OAuth 2.0 protocol, so the same flow works with Flask, Django, FastAPI, or plain requests.
• Robust documentation: GitHub’s developer docs provide clear examples and a sandbox for testing.

Prerequisites Before You Start

• Python 3.8+ installed on your development machine.
• A GitHub account (free or paid) to create an OAuth App.
• Basic knowledge of HTTP, redirects, and JSON.
• One of the following web frameworks installed:
  • Flask (pip install Flask)
  • Django (pip install Django)

Step 1: Register Your Application on GitHub

GitHub needs to know which application is requesting access. Follow these steps to create an OAuth App:

1. Log in to GitHub and navigate to Settings → Developer settings → OAuth Apps.
2. Click New OAuth App and fill in the form:
   • Application name: e.g., MyPythonOAuthDemo
   • Homepage URL: the public URL of your app (e.g., https://example.com)
   • Authorization callback URL: the endpoint that will receive the code, such as https://example.com/auth/callback
3. After saving, GitHub will provide a Client ID and a Client Secret. Store them securely—never commit the secret to version control.

Step 2: Understanding the OAuth 2.0 Flow

The flow consists of four core steps. Visualizing them helps you debug problems quickly.

1️⃣ User clicks “Login with GitHub” → 
2️⃣ Your app redirects to https://github.com/login/oauth/authorize (Authorization Request) → 
3️⃣ GitHub authenticates the user and redirects back to your callback URL with a temporary code → 
4️⃣ Your server exchanges the code for an access_token → 
5️⃣ Use the access_token to call GitHub APIs (e.g., fetch user profile)

2️⃣ Authorization Request

Build a URL that includes your client_id, requested scope, and a random state parameter to protect against CSRF attacks.

https://github.com/login/oauth/authorize?
    client_id=YOUR_CLIENT_ID
    &redirect_uri=https%3A%2F%2Fexample.com%2Fauth%2Fcallback
    &scope=read:user%20user:email
    &state=RANDOM_STRING

3️⃣ Callback & Code Exchange

GitHub redirects the user to your callback URL with two query parameters: code and state. Verify the state matches the one you generated, then POST the code to GitHub’s token endpoint.

POST https://github.com/login/oauth/access_token
Headers: Accept: application/json
Body:
    client_id=YOUR_CLIENT_ID
    &client_secret=YOUR_CLIENT_SECRET
    &code=RECEIVED_CODE
    &redirect_uri=YOUR_CALLBACK_URL
    &state=ORIGINAL_STATE

The response contains an access_token (and optionally a refresh_token for GitHub Enterprise). Store this token in a secure session or database.

4️⃣ Making Authenticated API Calls

All subsequent GitHub API requests include the token in an Authorization: token <access_token> header.

GET https://api.github.com/user
Headers:
    Authorization: token OAUTH_ACCESS_TOKEN
    Accept: application/vnd.github.v3+json

Step 3: Implementing the Flow in Flask

The following minimal Flask app demonstrates the complete OAuth cycle. Replace the placeholder values with your real credentials.

import os
import secrets
from urllib.parse import urlencode

import requests
from flask import Flask, redirect, request, session, url_for, render_template_string

app = Flask(__name__)
app.secret_key = os.getenv('FLASK_SECRET_KEY', secrets.token_hex(16))

# ---- Configuration ----
CLIENT_ID = os.getenv('GITHUB_CLIENT_ID')
CLIENT_SECRET = os.getenv('GITHUB_CLIENT_SECRET')
AUTH_BASE_URL = 'https://github.com/login/oauth/authorize'
TOKEN_URL = 'https://github.com/login/oauth/access_token'
API_BASE_URL = 'https://api.github.com'

# ---- Helper ----
def github_auth_url(state):
    params = {
        'client_id': CLIENT_ID,
        'redirect_uri': url_for('callback', _external=True),
        'scope': 'read:user user:email',
        'state': state,
    }
    return f"{AUTH_BASE_URL}?{urlencode(params)}"

# ---- Routes ----
@app.route('/')
def index():
    user = session.get('github_user')
    if user:
        return render_template_string(
            '
Logged in as {{ user["login"] }}
'
            '
Logout
',
            user=user,
        )
    return 'Login with GitHub'

@app.route('/login')
def login():
    state = secrets.token_urlsafe(16)
    session['oauth_state'] = state
    return redirect(github_auth_url(state))

@app.route('/auth/callback')
def callback():
    # Verify state to prevent CSRF
    state = request.args.get('state')
    if not state or state != session.pop('oauth_state', None):
        return 'Invalid state parameter', 400

    code = request.args.get('code')
    if not code:
        return 'Missing code parameter', 400

    # Exchange code for access token
    token_resp = requests.post(
        TOKEN_URL,
        headers={'Accept': 'application/json'},
        data={
            'client_id': CLIENT_ID,
            'client_secret': CLIENT_SECRET,
            'code': code,
            'redirect_uri': url_for('callback', _external=True),
            'state': state,
        },
    )
    token_json = token_resp.json()
    access_token = token_json.get('access_token')
    if not access_token:
        return f"Error retrieving token: {token_json}", 400

    # Fetch user profile
    user_resp = requests.get(
        f"{API_BASE_URL}/user",
        headers={'Authorization': f'token {access_token}'},
    )
    session['github_user'] = user_resp.json()
    return redirect(url_for('index'))

@app.route('/logout')
def logout():
    session.clear()
    return redirect(url_for('index'))

if __name__ == '__main__':
    app.run(debug=True)

Key points highlighted in the code:

• State validation: Prevents CSRF attacks.
• Secure session handling via Flask’s secret key.
• Use of Accept: application/json to receive a JSON token response.
• Storing only the minimal user data needed for the session.

Step 4: Implementing the Flow in Django (Optional)

If you prefer Django, the same steps apply. Below is a concise view‑function example that you can drop into a views.py file.

import os, secrets, requests

from urllib.parse import urlencode

from django.shortcuts import redirect, render

from django.http import HttpResponseBadRequest

from django.conf import settings

CLIENT_ID = os.getenv('GITHUB_CLIENT_ID')

CLIENT_SECRET = os.getenv('GITHUB_CLIENT_SECRET')

REDIRECT_URI = 'https://yourdomain.com/github/callback/'
def github_login(request):

    state = secrets.token_urlsafe(16)

    request.session['oauth_state'] = state

    params = {

        'client_id': CLIENT_ID,

        'redirect_uri': REDIRECT_URI,

        'scope': 'read:user user:email',

        'state': state,

    }

    return redirect('https://github.com/login/oauth/authorize?' + urlencode(params))
def github_callback(request):

    state = request.GET.get('state')

    if not state or state != request.session.pop('oauth_state', None):

        return HttpResponseBadRequest('Invalid state')

    code = request.GET.get('code')

    token_resp =