Login_required decorator in Flask - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of the login_required decorator in Flask?

The login_required decorator ensures that a user must be logged in to access a specific route or view. If the user is not logged in, they are redirected to the login page.

beginner

How do you apply the login_required decorator to a Flask route?

You place @login_required above the route function definition. For example:

@app.route('/dashboard')
@login_required
def dashboard():
    return 'Welcome!'

beginner

Which Flask extension provides the login_required decorator?

The Flask-Login extension provides the login_required decorator to manage user sessions and protect routes.

beginner

What happens if a user who is not logged in tries to access a route protected by login_required?

They are redirected to the login page, usually specified by the login_view setting in Flask-Login. This prevents unauthorized access.

intermediate

Can you customize where users are redirected if they are not logged in when using login_required?

Yes, you can set the login page route by configuring login_manager.login_view in your Flask app. For example:

login_manager.login_view = 'login'

What does the login_required decorator do in Flask?

A Encrypts user passwords

B Logs the user out automatically

C Creates a new user account

D Prevents access to a route if the user is not logged in

The login_required decorator restricts access to routes for users who are not logged in.

Which Flask extension must you install to use login_required?

A Flask-Login

B Flask-Mail

C Flask-WTF

D Flask-Migrate

login_required is provided by the Flask-Login extension.

If a user is not logged in and tries to access a protected route, what happens?

A They see a 404 error

B They are redirected to the login page

C They get access anyway

D The server crashes

Users not logged in are redirected to the login page when accessing routes with login_required.

How do you specify the login page URL for login_required redirection?

A By creating a <code>/login</code> route only

B By setting <code>app.secret_key</code>

C By setting <code>login_manager.login_view</code>

D By using <code>@app.before_request</code>

You configure login_manager.login_view to set the login page URL.

Where do you place the @login_required decorator in your Flask code?

A Above the route function

B Inside the route function

C After the route function

D In the HTML template

Decorators like @login_required go above the route function definition.

Explain how the login_required decorator works in Flask and why it is useful.

Think about what happens when a user tries to visit a page without logging in.

Describe the steps to protect a Flask route using login_required.

Consider setup and usage in code.

Practice

1. What is the main purpose of the @login_required decorator in Flask?

easy

A. To automatically log out users after a timeout

B. To restrict access to a view so only logged-in users can see it

C. To register a new user in the database

D. To display a welcome message on the homepage

Solution

1. Step 1: Understand the role of @login_required

   This decorator is used to protect routes so only authenticated users can access them.

2. Step 2: Identify what it does in Flask-Login

   If a user is not logged in, it redirects them to the login page instead of showing the protected content.

3. Final Answer:

   To restrict access to a view so only logged-in users can see it -> Option B

4. Quick Check:

   Access control = Restrict to logged-in users [OK]

Hint: Think: Who should see this page? Only logged-in users! [OK]

Common Mistakes:

• Confusing login_required with user registration
• Thinking it logs out users automatically
• Assuming it shows messages instead of restricting access

2. Which of the following is the correct way to use the @login_required decorator in a Flask view function?

easy

A. def @login_required my_view(): pass

B. def my_view() @login_required: pass

C. @login_required
def my_view(): pass

D. my_view = login_required(def my_view()): pass

Solution

1. Step 1: Recall Python decorator syntax

   Decorators are placed on the line above the function with an @ symbol, then the function is defined normally.

2. Step 2: Match correct syntax for @login_required

   @login_required def my_view(): pass correctly places @login_required above the function definition.

3. Final Answer:

   @login_required\ndef my_view(): pass -> Option C

4. Quick Check:

   Decorator above function = @login_required def my_view(): pass [OK]

Hint: Decorator always goes on the line before the function [OK]

Common Mistakes:

• Placing @login_required inside the function signature
• Trying to use @login_required after function definition
• Using invalid Python syntax for decorators

3. Given this Flask route with @login_required:

@app.route('/dashboard')
@login_required
def dashboard():
    return 'Welcome to your dashboard'

What happens if a user who is NOT logged in tries to visit /dashboard?

medium

A. They are redirected to the login page

B. They get a 404 Not Found error

C. They see the message 'Welcome to your dashboard'

D. The server crashes with an error

Solution

1. Step 1: Understand @login_required behavior

   This decorator checks if the user is authenticated before allowing access.

2. Step 2: What happens if user is not logged in?

   The decorator redirects unauthenticated users to the login page automatically.

3. Final Answer:

   They are redirected to the login page -> Option A

4. Quick Check:

   Not logged in = redirect to login [OK]

Hint: Not logged in? Redirect to login page! [OK]

Common Mistakes:

• Thinking the page content shows anyway
• Assuming a 404 error occurs
• Believing the server crashes

4. Consider this Flask code snippet:

from flask_login import login_required

@app.route('/profile')
def profile():
    return 'User Profile'

Why will this code NOT restrict access to logged-in users?

medium

A. Because the function name must be login_required

B. Because login_required must be imported from flask, not flask_login

C. Because the route decorator must come after @login_required

D. Because @login_required is missing above the profile function

Solution

1. Step 1: Check if @login_required is applied

   The function profile lacks the @login_required decorator above it.

2. Step 2: Understand decorator order and import

   Import from flask_login is correct, and route decorator order is flexible, but missing @login_required means no access restriction.

3. Final Answer:

   Because @login_required is missing above the profile function -> Option D

4. Quick Check:

   Missing decorator = no restriction [OK]

Hint: Decorator must be above function to restrict access [OK]

Common Mistakes:

• Thinking import location causes the issue
• Believing decorator order is wrong
• Assuming function name affects access control

5. You want to protect multiple routes in your Flask app so only logged-in users can access them. Which approach correctly protects these routes without repeating the @login_required decorator on each function? A) Use a custom decorator that wraps @login_required and apply it to each function B) Apply @login_required once on the Flask app object C) Add @login_required only to the first route function and it applies to all others D) Use Flask's before_request to check login status and redirect if needed

hard

A. Use Flask's before_request to check login status and redirect if needed

B. Apply @login_required once on the Flask app object

C. Add @login_required only to the first route function and it applies to all others

D. Use a custom decorator that wraps @login_required and apply it to each function

Solution

1. Step 1: Understand how to protect multiple routes efficiently

   Applying @login_required individually works but is repetitive.

2. Step 2: Use before_request to check login once for all routes

   Flask's before_request runs before every request, so you can check if the user is logged in and redirect if not, protecting multiple routes centrally.

3. Step 3: Evaluate other options

   Use a custom decorator that wraps @login_required and apply it to each function still requires decorating each function. Apply @login_required once on the Flask app object is invalid because @login_required is not applied to the app object. Add @login_required only to the first route function and it applies to all others is incorrect because decorators do not cascade to other functions.

4. Final Answer:

   Use Flask's before_request to check login status and redirect if needed -> Option A

5. Quick Check:

   Central login check = before_request [OK]

Hint: Use before_request for one check on all routes [OK]

Common Mistakes:

• Thinking one decorator on app protects all routes
• Assuming decorators cascade automatically
• Not knowing about before_request hook