User Session Management with Flask-Login0%
Role-Based Access Control & Custom Decorators

User Session Management with Flask-Login

Beginner12 min read•Updated: Jul 11, 2026
Study MaterialsCheatsheet

User Session Management with Flask-Login

Once a user verifies their credentials, an application must persist their authenticated state across subsequent requests without asking them to re-enter their password on every page click.

Flask-Login is the standard extension for managing user session lifecycles in Flask. It handles logging users in, logging them out, tracking active sessions via cookies, and protecting views with the @login_required decorator.

1. Installing and Configuring Flask-Login

Install the extension:

Bash / Terminal
pip install flask-login

In app.py:

Python
from flask import Flask
from flask_login import LoginManager
 
app = Flask(__name__)
app.config["SECRET_KEY"] = "super-secret-session-key"
 
login_manager = LoginManager()
login_manager.init_app(app)
 
# Specify the route endpoint where unauthenticated users should be redirected
login_manager.login_view = "login"
login_manager.login_message = "Please log in to access this page."
login_manager.login_message_category = "warning"

2. Implementing the UserMixin on Your User Model

Flask-Login requires your User model to implement four attributes/methods:

  • is_authenticated: Returns True if user is logged in.
  • is_active: Returns True if user account is active and unbanned.
  • is_anonymous: Returns False for real users.
  • get_id(): Returns a unique string identifying the user.

Instead of writing these manually, subclass flask_login.UserMixin:

Python
from flask_login import UserMixin
from flask_sqlalchemy import SQLAlchemy
 
db = SQLAlchemy()
 
class User(UserMixin, db.Model):
__tablename__ = "users"
id = db.Column(db.Integer, primary_key=True)
username = db.Column(db.String(50), unique=True, nullable=False)
password_hash = db.Column(db.String(256), nullable=False)
role = db.Column(db.String(20), default="student")

3. The user_loader Callback

Flask-Login stores only the user's ID inside the encrypted session cookie. On each incoming request, Flask-Login invokes a callback function you register with @login_manager.user_loader to fetch the full User object from the database:

Python
@login_manager.user_loader
def load_user(user_id):
# user_id is passed as a string by Flask-Login
return User.query.get(int(user_id))

If the ID is invalid or user no longer exists, the callback must return None.

4. Authenticating Users (login_user, logout_user, current_user)

Python
from flask import render_template, redirect, url_for, flash, request
from flask_login import login_user, logout_user, login_required, current_user
from werkzeug.security import check_password_hash
from models import User
 
@app.route("/login", methods=["GET", "POST"])
def login():
if current_user.is_authenticated:
return redirect(url_for("dashboard"))
if request.method == "POST":
username = request.form.get("username")
password = request.form.get("password")
remember = request.form.get("remember") == "on"
user = User.query.filter_by(username=username).first()
if user and check_password_hash(user.password_hash, password):
# Log the user into session
# remember=True issues a persistent 'remember me' cookie
login_user(user, remember=remember)
flash("Welcome back!", "success")
# Handle post-login redirection (e.g. ?next=/profile)
next_page = request.args.get("next")
return redirect(next_page or url_for("dashboard"))
else:
flash("Invalid username or password.", "danger")
return render_template("login.html")
 
@app.route("/logout")
@login_required
def logout():
logout_user()
flash("You have been signed out.", "info")
return redirect(url_for("home"))

5. Protecting Routes with @login_required

To restrict access to authenticated members only, decorate the view function with @login_required:

Python
@app.route("/dashboard")
@login_required
def dashboard():
# current_user is available everywhere!
return render_template("dashboard.html", user=current_user)

In templates, current_user is globally accessible without explicitly passing it from Python:

HTML
{% if current_user.is_authenticated %}
<p>Logged in as: {{ current_user.username }}</p>
<a href="{{ url_for('logout') }}">Sign Out</a>
{% else %}
<a href="{{ url_for('login') }}">Sign In</a>
{% endif %}
Interactive Quiz

Practice Quiz

Question 1
What base class can be mixed into a User model to provide Flask-Login's required authentication properties automatically?
Question 2
What is the purpose of the @login_manager.user_loader callback function?
Question 3
What decorator prevents unauthenticated users from accessing a route in Flask-Login?
Question 4
How is the currently authenticated user accessed inside Jinja2 templates?
Question 5
What does setting remember=True in login_user(user, remember=True) do?
Next Lesson

Role-Based Access Control & Custom Decorators

Continue learning with hands-on practice, examples, and exercises in the upcoming topic.

Related Lessons

Previous LessonNext Lesson
Password Hashing with Werkzeug SecurityRole-Based Access Control & Custom Decorators

Practice Quiz

Test your understanding of this lesson with 5 questions. Each question has one correct answer.

PreviousNext
PrevNext