Use the standard flask-security

[jma]

It would be great to use the standard flask-security (https://flask-security-too.readthedocs.io/en/stable/) package as it contains a lot of new features.

[slint]

The reason we initially decided to maintain our own fork of Flask-Security-Too was actually partially related to the new features:

• Authentication needs in Invenio are fairly stable and focused (local accounts, OAuth), while Flask-Security-Too continues to add features (like passwordless auth, alternative storage backends, etc.) that aren't always relevant to our use cases.
• We prefer to keep our authentication layer as simple and focused as possible to minimize the attack surface. Adding more features, even if we don't use them, increases the potential security risks (and Flask-Security-Too has had security patches related to newer features).
• Given the somewhat fragmented Flask authentication ecosystem, we found that maintaining our own fork gives us better control and stability in the long run.

That said, if there are specific features from Flask-Security-Too that you think would be particularly valuable for our project, we'd be happy to discuss them here and see if e.g. cherry-picking them would be an option.

[jma]

Many thanks for your reply.
We are really interested to have a double authentication.

Many thanks in advance.