Official solution
SimpleLogin flow pehle poochta hai "tu kaun hai?", token milne ke baad har API pe wohi proof dikhate ho.
Authentication step: Vue form email + password JSON POST karta hai. Flask user dhoondhta hai, check_password_hash se prove karta hai ki tum genuine ho. Galat 401. Sahi pe JWT + role milta hai — yeh session/token hai.
Vue localStorage (ya cookie) mein token rakhta hai, dashboard pe router.push. Aage ki har fetch header: Authorization: Bearer <token>. @jwt_required identity check (authentication). @roles_required('admin') permission check (authorization) — logged in ho, lekin allowed nahi to 403.
Validation alag cheez hai: empty email, password 8+ — form sahi bhara hai ya nahi. Woh identity prove nahi karta.
Logout = client token delete + login page. Server blacklist optional. Password response JSON mein kabhi mat bhejo.
Example
# Authentication
@app.route('/api/login', methods=['POST'])
def login():
u = User.query.filter_by(email=data['email']).first()
if not u or not check_password_hash(u.password, data['password']):
return jsonify(msg='bad'), 401
return jsonify(token=create_access_token(u.id), role=u.role)
# baad ki APIs
# Authorization: Bearer <token>
if current_user.role != 'admin':
abort(403)
Project example: Login.vue POST /api/login → token LS → interceptor. Student token se admin route = 403. Empty form = validation, galat password = 401.
Viva tipNetwork tab mein password body dikhega localhost pe — prod HTTPS. Response mein hash/password echo mat karo.