diff --git a/ereuse_devicehub/config.py b/ereuse_devicehub/config.py
index e1e5cf12..5c25e43b 100644
--- a/ereuse_devicehub/config.py
+++ b/ereuse_devicehub/config.py
@@ -36,6 +36,7 @@ class DevicehubConfig(Config):
                                      import_resource(metric_def),
                                ),)
     PASSWORD_SCHEMES = {'pbkdf2_sha256'}  # type: Set[str]
+    SECRET_KEY = config('SECRET_KEY')
     DB_USER = config('DB_USER', 'dhub')
     DB_PASSWORD = config('DB_PASSWORD', 'ereuse')
     DB_HOST = config('DB_HOST', 'localhost')
diff --git a/ereuse_devicehub/devicehub.py b/ereuse_devicehub/devicehub.py
index ea951472..b3ed0eba 100644
--- a/ereuse_devicehub/devicehub.py
+++ b/ereuse_devicehub/devicehub.py
@@ -23,6 +23,11 @@ from ereuse_devicehub.resources.inventory import Inventory, InventoryDef
 from ereuse_devicehub.templating import Environment
 
 
+from flask_login import LoginManager
+from flask_wtf.csrf import CSRFProtect
+from ereuse_devicehub.resources.user.models import User
+
+
 class Devicehub(Teal):
     test_client_class = Client
     Dummy = Dummy
@@ -63,6 +68,20 @@ class Devicehub(Teal):
         inv.command('search')(self.regenerate_search)
         self.before_request(self._prepare_request)
 
+        self.configure_extensions()
+
+    def configure_extensions(self):
+        # configure & enable CSRF of Flask-WTF
+        CSRFProtect(self)
+
+        # configure Flask-Login
+        login_manager = LoginManager()
+        login_manager.init_app(self)
+
+        @login_manager.user_loader
+        def load_user(user_id):
+            return User.query.get(user_id)
+
     # noinspection PyMethodOverriding
     @click.option('--name', '-n',
                   default='Test 1',