Login_required decorator in Flask - Step-by-Step Execution

Concept Flow - Login_required decorator

User requests protected page

↓

Check if user is logged in

↓

Allow access

↓

Show page

↓

Redirect back to page

This flow shows how the login_required decorator checks if a user is logged in before allowing access to a page, otherwise redirects to login.

Execution Sample

Flask

from flask import Flask, redirect, url_for, session
from functools import wraps

def login_required(f):
    @wraps(f)
    def decorated_function(*args, **kwargs):
        if 'user' not in session:
            return redirect(url_for('login'))
        return f(*args, **kwargs)
    return decorated_function

This code defines a login_required decorator that redirects users to login if they are not logged in.

Execution Table

Step	Action	Session State	Condition ('user' in session?)	Branch Taken	Result
1	User requests protected page	{}	False	Redirect to login	Redirect to /login
2	User visits login page and logs in	{'user': 'alice'}	N/A	N/A	User logged in
3	User requests protected page again	{'user': 'alice'}	True	Allow access	Show protected page
4	User logs out, session cleared	{}	N/A	N/A	User logged out
5	User requests protected page after logout	{}	False	Redirect to login	Redirect to /login

💡 Execution stops when user is either redirected to login or allowed access based on session state.

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	After Step 5
session	{}	{}	{'user': 'alice'}	{'user': 'alice'}	{}	{}
condition ('user' in session)	False	False	True	True	False	False

Key Moments - 3 Insights

Why does the user get redirected to login even if they just visited the protected page?

Because the session does not contain 'user' key at that moment (see Step 1 in execution_table), so the condition fails and redirect happens.

What happens if the session has 'user' key?

The condition 'user' in session is True (Step 3), so the decorator allows access and the protected page is shown.

Why do we use @wraps in the decorator?

To preserve the original function's name and docstring, which helps Flask routing and debugging (not shown in execution but important).

Visual Quiz - 3 Questions

Look at the execution_table, what is the session state at Step 3?

A {}

B {'user': 'bob'}

C {'user': 'alice'}

D None

💡 Hint

Check the 'Session State' column at Step 3 in the execution_table.

At which step does the condition 'user' in session become True?

A Step 2

B Step 3

C Step 1

D Step 5

💡 Hint

Look at the 'Condition' column in the execution_table to find when it is True.

If the session never had 'user' key, what would happen at Step 5?

A User is redirected to login

B User sees the protected page

C An error occurs

D Nothing happens

💡 Hint

Refer to the 'Branch Taken' and 'Result' columns at Step 5 in the execution_table.

Concept Snapshot

login_required decorator:
- Wraps a view function
- Checks if 'user' in session
- If not, redirects to login page
- Otherwise, runs the original function
- Keeps user from accessing pages without login

Full Transcript

The login_required decorator in Flask checks if a user is logged in by looking for a 'user' key in the session. When a user requests a protected page, the decorator runs first. If the user is not logged in (no 'user' in session), it redirects them to the login page. After logging in, the user can access the protected page. If the user logs out, the session clears and access is again blocked until login. This flow ensures only logged-in users see protected content.