Login form and verification in Flask - Performance & Optimization

Performance: Login form and verification

MEDIUM IMPACT

This affects page load speed and interaction responsiveness during user login.

Handling user login form submission and verification

Flask

from flask import Flask, request, render_template, jsonify
import asyncio
app = Flask(__name__)

async def verify_user_async(username, password):
    # Simulate async verification
    await asyncio.sleep(0.1)
    return username == 'user' and password == 'pass'

@app.route('/login', methods=['GET', 'POST'])
async def login():
    if request.method == 'POST':
        data = await request.get_json()
        username = data.get('username')
        password = data.get('password')
        valid = await verify_user_async(username, password)
        if valid:
            return jsonify({'status': 'success'})
        else:
            return jsonify({'status': 'fail'})
    return render_template('login.html')

Using async verification avoids blocking server threads, improving response time and UI responsiveness.

📈 Performance GainReduces blocking time by 100-400ms, improving INP and user experience

Handling user login form submission and verification

Flask

from flask import Flask, request, render_template
app = Flask(__name__)

@app.route('/login', methods=['GET', 'POST'])
def login():
    if request.method == 'POST':
        username = request.form['username']
        password = request.form['password']
        # Synchronous blocking verification
        user = verify_user_blocking(username, password)  # blocking call
        if user:
            return 'Login successful'
        else:
            return 'Login failed'
    return render_template('login.html')

Blocking verification delays server response, causing slow interaction and poor user experience.

📉 Performance CostBlocks rendering and response for 200-500ms depending on verification complexity

Performance Comparison

Pattern	DOM Operations	Reflows	Paint Cost	Verdict
Synchronous blocking verification	Minimal (form only)	0	Low	[X] Bad
Asynchronous non-blocking verification	Minimal (form only)	0	Low	[OK] Good

Rendering Pipeline

Login form submission triggers server verification which affects server response time and client rendering of results.

→Network

→Server Processing

→Client Rendering

⚠️ BottleneckServer Processing during synchronous verification

Core Web Vital Affected

INP

This affects page load speed and interaction responsiveness during user login.

Optimization Tips

1Avoid synchronous blocking calls during login verification to keep server responsive.

2Use asynchronous verification methods to improve interaction speed and reduce server wait.

3Keep login form DOM minimal to avoid unnecessary reflows and paints.

Performance Quiz - 3 Questions

What is the main performance issue with synchronous login verification in Flask?

A It blocks server threads causing slower response times

B It increases DOM nodes causing layout thrashing

C It causes excessive CSS recalculations

D It increases bundle size significantly

DevTools: Performance

How to check: Record a performance profile while submitting the login form and observe server response time and main thread blocking.

What to look for: Look for long tasks blocking the main thread and slow server response times indicating blocking verification.

Practice

1. What is the main purpose of a login form in a Flask web application?

easy

A. To create database tables

B. To display images on the webpage

C. To collect username and password from users

D. To send emails automatically

Solution

1. Step 1: Understand the role of a login form

   A login form is designed to collect user credentials like username and password.

2. Step 2: Identify the correct purpose in Flask context

   In Flask, the login form collects these details to verify user identity before granting access.

3. Final Answer:

   To collect username and password from users -> Option C

4. Quick Check:

   Login form = collect credentials [OK]

Hint: Login forms always gather user credentials [OK]

Common Mistakes:

• Confusing login form with other features like email or images
• Thinking login form creates database tables
• Assuming login form sends emails automatically

2. Which Flask code snippet correctly defines a route to display a login form using GET method?

easy

A. app.route('/login', methods=['GET'])\ndef login():\n return render_template('login.html')

B. app.route('/login', methods=['POST'])\ndef login():\n return render_template('login.html')

C. app.route('/login')\ndef login():\n return redirect('/home')

D. app.route('/login', methods=['DELETE'])\ndef login():\n return 'Delete method not allowed'

Solution

1. Step 1: Identify the correct HTTP method for showing a form

   Login forms are usually shown with GET requests, so methods=['GET'] is correct.

2. Step 2: Check the route and function return

   The route '/login' with methods=['GET'] returns the login.html template to display the form.

3. Final Answer:

   app.route('/login', methods=['GET'])\ndef login():\n return render_template('login.html') -> Option A

4. Quick Check:

   Show form = GET method [OK]

Hint: Use GET method to display forms in Flask routes [OK]

Common Mistakes:

• Using POST method to show the form instead of GET
• Not specifying methods list defaults to GET but unclear
• Using DELETE method which is invalid for forms

3. Given this Flask login verification code snippet, what will be the output if username='admin' and password='1234' are submitted?

from flask import Flask, request, render_template_string
app = Flask(__name__)

@app.route('/login', methods=['POST'])
def login():
    user = request.form.get('username')
    pwd = request.form.get('password')
    if user == 'admin' and pwd == '1234':
        return 'Login successful'
    else:
        return 'Login failed'

medium

A. Login successful

B. Login failed

C. SyntaxError

D. No output

Solution

1. Step 1: Check the submitted username and password

   The code compares user to 'admin' and pwd to '1234'. Both match the submitted values.

2. Step 2: Determine the returned response

   Since both match, the function returns 'Login successful'.

3. Final Answer:

   Login successful -> Option A

4. Quick Check:

   Correct credentials = Login successful [OK]

Hint: Match input values exactly to get success message [OK]

Common Mistakes:

• Confusing POST and GET methods for form data
• Assuming wrong output when credentials match
• Ignoring case sensitivity in username/password

4. Identify the error in this Flask login route code:

@app.route('/login', methods=['POST'])
def login():
    username = request.form['username']
    password = request.form['password']
    if username = 'user' and password = 'pass':
        return 'Welcome!'
    else:
        return 'Invalid credentials'

medium

A. No return statement in the function

B. Missing 'methods' argument in @app.route decorator

C. Incorrect use of request.args instead of request.form

D. Using '=' instead of '==' in the if condition

Solution

1. Step 1: Check the if condition syntax

   The code uses single '=' which is assignment, not comparison. It should be '==' to compare values.

2. Step 2: Verify other parts of the code

   The methods argument is present, request.form is correctly used, and return statements exist.

3. Final Answer:

   Using '=' instead of '==' in the if condition -> Option D

4. Quick Check:

   Comparison needs '==' not '=' [OK]

Hint: Use '==' for comparisons, '=' is assignment [OK]

Common Mistakes:

• Using '=' instead of '==' in conditions
• Forgetting to specify POST method in route
• Using request.args for POST form data

5. You want to create a Flask login system that locks out a user after 3 failed attempts. Which approach correctly combines login verification and attempt tracking?

hard

A. Use a global variable to count attempts and reset on successful login

B. Store attempt count in session and check before verifying credentials

C. Check attempts only after successful login to reset count

D. Ignore attempt count and always allow login attempts

Solution

1. Step 1: Understand where to store attempt count

   Using session storage per user is best to track attempts individually without global conflicts.

2. Step 2: Implement logic to check attempts before verifying credentials

   Check if attempts exceed 3 before allowing login verification to prevent further tries.

3. Step 3: Reset attempt count on successful login

   Resetting attempts after success avoids locking out valid users.

4. Final Answer:

   Store attempt count in session and check before verifying credentials -> Option B

5. Quick Check:

   Session tracks attempts per user [OK]

Hint: Use session to track attempts and block after limit [OK]

Common Mistakes:

• Using global variables causing shared count for all users
• Resetting attempts only after success but not checking before login
• Ignoring attempt limits and allowing unlimited tries