Flask User Authentication: Implementing Login Functionality with Flask-Login

In web applications, user authentication is the foundation for ensuring data security and personalized experiences. For example, only logged-in users can access features like personal centers or submit orders. Flask-Login is a lightweight Flask extension specifically designed to manage user sessions and simplify the implementation of login, logout, and permission control. This article will guide you through implementing user login functionality based on Flask-Login in the simplest way possible, step by step.

Without Flask-Login, you would need to manually handle user sessions (e.g., storing user IDs in session), verify passwords, and manage login states. Flask-Login encapsulates these logics, allowing you to achieve core functionality with just a few lines of code:
- Automatically maintain user sessions (by storing user IDs)
- Provide the @login_required decorator to protect routes
- Handle core login/logout logic

2. Prerequisites¶

First, install the required libraries:

pip install flask flask-login

The core of Flask-Login is the LoginManager, which manages user sessions and login states. Additionally, you need a “user model” to store user information (simulated here with a simple class).

3. Implementation Steps (with Code)¶

from flask import Flask, render_template, redirect, url_for, request, flash
from flask_login import LoginManager, UserMixin, login_user, login_required, logout_user, current_user

# Initialize Flask app
app = Flask(__name__)
app.secret_key = 'your-secret-key-here'  # Required for encrypting session data

# Initialize Flask-Login's LoginManager
login_manager = LoginManager()
login_manager.init_app(app)
login_manager.login_view = 'login'  # Redirect route for unauthenticated access (e.g., /login)

2. Create the User Model¶

Flask-Login requires user classes to inherit UserMixin, which automatically implements properties like is_authenticated and is_active (no need to write these methods manually). We use a simple User class to simulate user data:

class User(UserMixin):
    def __init__(self, user_id, username, password):
        self.id = user_id  # User ID (required)
        self.username = username  # Username
        self.password = password  # Password (encrypt in production!)

# Simulated user database (use SQLite/MySQL in real projects)
users_db = {
    1: User(id=1, username='admin', password='123456'),
    2: User(id=2, username='guest', password='654321')
}

3. Implement the User Loading Function (Critical!)¶

Flask-Login needs to know how to load a user from the session. The user_loader callback fetches the user from the database using the user ID:

@login_manager.user_loader
def load_user(user_id):
    """Load user object based on user ID from the database"""
    return users_db.get(int(user_id))  # Query from simulated database

Create a login view function to handle user input, verify credentials, and call login_user(user) to record the session upon success:

@app.route('/login', methods=['GET', 'POST'])
def login():
    if request.method == 'POST':
        # Get user input
        username = request.form.get('username')
        password = request.form.get('password')

        # Simulate user authentication (encrypt passwords in production!)
        user = None
        for u in users_db.values():
            if u.username == username and u.password == password:
                user = u
                break

        if user:
            # Login success: record session
            login_user(user)  # Stores user ID in session
            return redirect(url_for('home'))  # Redirect to home page
        else:
            flash('Invalid username or password!')  # Show error message

    # Render login form for GET requests
    return render_template('login.html')

5. Implement Logout Functionality¶

Call logout_user() to clear the session when a user logs out:

@app.route('/logout')
@login_required  # Only authenticated users can access this route
def logout():
    logout_user()  # Clear session
    return redirect(url_for('home'))  # Redirect to home page

6. Protect Routes with Authentication¶

Use the @login_required decorator to mark routes that require authentication:

@app.route('/profile')
@login_required  # Redirects unauthenticated users to login_view
def profile():
    """Personal center: Only accessible to logged-in users"""
    return f"Welcome back, {current_user.username}!"

7. Home Page and Templates¶

The home page displays welcome messages and login status:

@app.route('/')
def home():
    return render_template('home.html')

home.html (templates/home.html):

<!DOCTYPE html>
<html>
<head>
    <title>Flask-Login Example</title>
</head>
<body>
    <h1>Home Page</h1>
    {% if current_user.is_authenticated %}
        <p>Current User: {{ current_user.username }}</p>
        <a href="{{ url_for('profile') }}">Go to Profile</a>
        <br>
        <a href="{{ url_for('logout') }}">Logout</a>
    {% else %}
        <p>You are not logged in. Please <a href="{{ url_for('login') }}">login</a></p>
    {% endif %}
</body>
</html>

login.html (templates/login.html):

<!DOCTYPE html>
<html>
<head>
    <title>Login</title>
</head>
<body>
    <h1>Login</h1>
    {% with messages = get_flashed_messages() %}
        {% if messages %}
            <p style="color: red;">{{ messages[0] }}</p>
        {% endif %}
    {% endwith %}
    <form method="POST">
        <input type="text" name="username" placeholder="Username" required><br><br>
        <input type="password" name="password" placeholder="Password" required><br><br>
        <button type="submit">Login</button>
    </form>
</body>
</html>

4. Testing the Application¶

Save the code to app.py and create a templates folder in the same directory with home.html and login.html.
Run the app: python app.py
Visit http://127.0.0.1:5000, click “Login”, and use the test credentials:
- Username: admin / Password: 123456
- Username: guest / Password: 654321

5. Important Notes¶

Password Security: Passwords are stored in plaintext here. In production, always use encryption (e.g., bcrypt or werkzeug.security with generate_password_hash and check_password_hash).
Session Security: Use a complex, random string for app.secret_key in production (avoid hardcoding).
Advanced Features: Flask-Login supports “Remember Me” (login_user(user, remember=True)), password reset, and role-based permissions.

6. Summary¶

Flask-Login simplifies user authentication with a clean API, handling core functionalities like login, logout, session management, and route protection. This article provided a basic example to get you started—expand further with databases and frontend frameworks (e.g., Bootstrap) for production use.

(Full code is available in the steps above; copy it to your local environment to test.)