Logout View

Logging out means removing the user id from the session.

Flask-Login provides:

• logout_user()

diagram logging out is about clearing state, not showing a page mermaid

  flowchart LR
  A["POST /logout"] --> B["logout_user()"]
  B --> C["remove user_id from the session"]
  B --> D["clear the remember-me cookie"]
  C --> E["current_user is anonymous"]
  D --> E
  E --> F["redirect to a public page"]
  F --> G["the next request has no identity"]

logout_user removes the user id from the session. The remember-me cookie has to be cleared too, or the very next request logs them straight back in -- which is the bug people hit when they only pop the session key by hand.

Example

python

from flask import redirect, url_for
from flask_login import logout_user, login_required
 
 
@app.route("/logout")
@login_required
def logout():
    logout_user()
    return redirect(url_for("home"))

Why protect logout with login_required?

It’s not strictly required, but:

• it keeps behavior consistent
• it avoids confusion when anonymous users hit /logout

UX note

It’s common to flash a message:

• “You’ve been logged out.”

And redirect to home.