Login_required decorator in Flask - Step-by-Step Execution

Concept Flow - Login_required decorator

User requests protected page

↓

Check if user is logged in

↓

Allow access

↓

Show page

↓

Redirect back to page

This flow shows how the login_required decorator checks if a user is logged in before allowing access to a page, otherwise redirects to login.

Execution Sample

Flask

from flask import Flask, redirect, url_for, session
from functools import wraps

def login_required(f):
    @wraps(f)
    def decorated_function(*args, **kwargs):
        if 'user' not in session:
            return redirect(url_for('login'))
        return f(*args, **kwargs)
    return decorated_function

This code defines a login_required decorator that redirects users to login if they are not logged in.

Execution Table

Step	Action	Session State	Condition ('user' in session?)	Branch Taken	Result
1	User requests protected page	{}	False	Redirect to login	Redirect to /login
2	User visits login page and logs in	{'user': 'alice'}	N/A	N/A	User logged in
3	User requests protected page again	{'user': 'alice'}	True	Allow access	Show protected page
4	User logs out, session cleared	{}	N/A	N/A	User logged out
5	User requests protected page after logout	{}	False	Redirect to login	Redirect to /login

💡 Execution stops when user is either redirected to login or allowed access based on session state.

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	After Step 5
session	{}	{}	{'user': 'alice'}	{'user': 'alice'}	{}	{}
condition ('user' in session)	False	False	True	True	False	False

Key Moments - 3 Insights

Why does the user get redirected to login even if they just visited the protected page?

Because the session does not contain 'user' key at that moment (see Step 1 in execution_table), so the condition fails and redirect happens.

What happens if the session has 'user' key?

The condition 'user' in session is True (Step 3), so the decorator allows access and the protected page is shown.

Why do we use @wraps in the decorator?

To preserve the original function's name and docstring, which helps Flask routing and debugging (not shown in execution but important).

Visual Quiz - 3 Questions

Look at the execution_table, what is the session state at Step 3?

A {}

B {'user': 'bob'}

C {'user': 'alice'}

D None

💡 Hint

Check the 'Session State' column at Step 3 in the execution_table.

At which step does the condition 'user' in session become True?

A Step 2

B Step 3

C Step 1

D Step 5

💡 Hint

Look at the 'Condition' column in the execution_table to find when it is True.

If the session never had 'user' key, what would happen at Step 5?

A User is redirected to login

B User sees the protected page

C An error occurs

D Nothing happens

💡 Hint

Refer to the 'Branch Taken' and 'Result' columns at Step 5 in the execution_table.

Concept Snapshot

login_required decorator:
- Wraps a view function
- Checks if 'user' in session
- If not, redirects to login page
- Otherwise, runs the original function
- Keeps user from accessing pages without login

Full Transcript

The login_required decorator in Flask checks if a user is logged in by looking for a 'user' key in the session. When a user requests a protected page, the decorator runs first. If the user is not logged in (no 'user' in session), it redirects them to the login page. After logging in, the user can access the protected page. If the user logs out, the session clears and access is again blocked until login. This flow ensures only logged-in users see protected content.

Practice

1. What is the main purpose of the @login_required decorator in Flask?

easy

A. To automatically log out users after a timeout

B. To restrict access to a view so only logged-in users can see it

C. To register a new user in the database

D. To display a welcome message on the homepage

Solution

1. Step 1: Understand the role of @login_required

   This decorator is used to protect routes so only authenticated users can access them.

2. Step 2: Identify what it does in Flask-Login

   If a user is not logged in, it redirects them to the login page instead of showing the protected content.

3. Final Answer:

   To restrict access to a view so only logged-in users can see it -> Option B

4. Quick Check:

   Access control = Restrict to logged-in users [OK]

Hint: Think: Who should see this page? Only logged-in users! [OK]

Common Mistakes:

• Confusing login_required with user registration
• Thinking it logs out users automatically
• Assuming it shows messages instead of restricting access

2. Which of the following is the correct way to use the @login_required decorator in a Flask view function?

easy

A. def @login_required my_view(): pass

B. def my_view() @login_required: pass

C. @login_required
def my_view(): pass

D. my_view = login_required(def my_view()): pass

Solution

1. Step 1: Recall Python decorator syntax

   Decorators are placed on the line above the function with an @ symbol, then the function is defined normally.

2. Step 2: Match correct syntax for @login_required

   @login_required def my_view(): pass correctly places @login_required above the function definition.

3. Final Answer:

   @login_required\ndef my_view(): pass -> Option C

4. Quick Check:

   Decorator above function = @login_required def my_view(): pass [OK]

Hint: Decorator always goes on the line before the function [OK]

Common Mistakes:

• Placing @login_required inside the function signature
• Trying to use @login_required after function definition
• Using invalid Python syntax for decorators

3. Given this Flask route with @login_required:

@app.route('/dashboard')
@login_required
def dashboard():
    return 'Welcome to your dashboard'

What happens if a user who is NOT logged in tries to visit /dashboard?

medium

A. They are redirected to the login page

B. They get a 404 Not Found error

C. They see the message 'Welcome to your dashboard'

D. The server crashes with an error

Solution

1. Step 1: Understand @login_required behavior

   This decorator checks if the user is authenticated before allowing access.

2. Step 2: What happens if user is not logged in?

   The decorator redirects unauthenticated users to the login page automatically.

3. Final Answer:

   They are redirected to the login page -> Option A

4. Quick Check:

   Not logged in = redirect to login [OK]

Hint: Not logged in? Redirect to login page! [OK]

Common Mistakes:

• Thinking the page content shows anyway
• Assuming a 404 error occurs
• Believing the server crashes

4. Consider this Flask code snippet:

from flask_login import login_required

@app.route('/profile')
def profile():
    return 'User Profile'

Why will this code NOT restrict access to logged-in users?

medium

A. Because the function name must be login_required

B. Because login_required must be imported from flask, not flask_login

C. Because the route decorator must come after @login_required

D. Because @login_required is missing above the profile function

Solution

1. Step 1: Check if @login_required is applied

   The function profile lacks the @login_required decorator above it.

2. Step 2: Understand decorator order and import

   Import from flask_login is correct, and route decorator order is flexible, but missing @login_required means no access restriction.

3. Final Answer:

   Because @login_required is missing above the profile function -> Option D

4. Quick Check:

   Missing decorator = no restriction [OK]

Hint: Decorator must be above function to restrict access [OK]

Common Mistakes:

• Thinking import location causes the issue
• Believing decorator order is wrong
• Assuming function name affects access control

5. You want to protect multiple routes in your Flask app so only logged-in users can access them. Which approach correctly protects these routes without repeating the @login_required decorator on each function? A) Use a custom decorator that wraps @login_required and apply it to each function B) Apply @login_required once on the Flask app object C) Add @login_required only to the first route function and it applies to all others D) Use Flask's before_request to check login status and redirect if needed

hard

A. Use Flask's before_request to check login status and redirect if needed

B. Apply @login_required once on the Flask app object

C. Add @login_required only to the first route function and it applies to all others

D. Use a custom decorator that wraps @login_required and apply it to each function

Solution

1. Step 1: Understand how to protect multiple routes efficiently

   Applying @login_required individually works but is repetitive.

2. Step 2: Use before_request to check login once for all routes

   Flask's before_request runs before every request, so you can check if the user is logged in and redirect if not, protecting multiple routes centrally.

3. Step 3: Evaluate other options

   Use a custom decorator that wraps @login_required and apply it to each function still requires decorating each function. Apply @login_required once on the Flask app object is invalid because @login_required is not applied to the app object. Add @login_required only to the first route function and it applies to all others is incorrect because decorators do not cascade to other functions.

4. Final Answer:

   Use Flask's before_request to check login status and redirect if needed -> Option A

5. Quick Check:

   Central login check = before_request [OK]

Hint: Use before_request for one check on all routes [OK]

Common Mistakes:

• Thinking one decorator on app protects all routes
• Assuming decorators cascade automatically
• Not knowing about before_request hook