Introduction to Flask-Login

Flask-Login is the standard extension for login/session management.

It helps you:

• log users in and out
• remember users across requests
• access current_user
• protect routes with @login_required

Install

bash

pip install Flask-Login

Minimal setup

python

from flask import Flask
from flask_login import LoginManager
 
app = Flask(__name__)
app.config["SECRET_KEY"] = "dev-key"
 
login_manager = LoginManager()
login_manager.init_app(app)
 
# where to redirect when login is required
login_manager.login_view = "login"

User model requirement

Your user model must implement:

• is_authenticated
• is_active
• is_anonymous
• get_id()

The easiest way is to inherit:

python

from flask_login import UserMixin
 
class User(UserMixin, db.Model):
    ...

current_user

Flask-Login provides:

python

from flask_login import current_user

current_user represents the user for the current request.

If not logged in, it’s an AnonymousUser object.

Visualize it

Here’s how a login request creates a session cookie that Flask-Login then uses to recognize the user on every later request.

diagram Flask-Login session flow mermaid

  sequenceDiagram
  participant Browser
  participant Server
  Browser->>Server: POST /login (username, password)
  Server->>Server: Check password hash
  Server->>Browser: Set session cookie + redirect
  Browser->>Server: Request with session cookie
  Server->>Server: Identify logged-in user

A login request creates a session cookie; later requests carry that cookie so the server can identify the user