Remember me functionality in Flask - Step-by-Step Execution

Concept Flow - Remember me functionality

User submits login form

↓

Check credentials

↓

Is 'Remember me' checked?

No→Create session cookie

|Yes↓

Create persistent cookie with token

↓

Send cookie to browser

↓

User closes browser

↓

User returns

↓

Check persistent cookie

↓

Auto-login user

↓

Grant access

↓

END

This flow shows how the app checks login, sets session or persistent cookies, and auto-logs in returning users with 'Remember me'.

Execution Sample

Flask

from flask import Flask, request, make_response
app = Flask(__name__)

@app.route('/login', methods=['POST'])
def login():
    username = request.form['username']
    remember = 'remember' in request.form
    resp = make_response('Logged in')
    if remember:
        resp.set_cookie('remember_token', 'abc123', max_age=30*24*60*60)
    else:
        resp.set_cookie('session', 'xyz789')
    return resp

This code logs in a user and sets a persistent cookie if 'Remember me' is checked, else a session cookie.

Execution Table

Step	Action	Input	Condition	Cookie Set	Output
1	User submits login form	username='user1', remember checked	N/A	N/A	Proceed to check credentials
2	Check credentials	username='user1'	Valid user?	N/A	Credentials valid
3	Check 'Remember me'	remember=True	Is remember checked?	N/A	Yes branch
4	Set cookie	remember=True	Set persistent cookie?	remember_token=abc123 (30 days)	Cookie set with token
5	Send response	N/A	N/A	remember_token cookie sent	Response sent to browser
6	User closes browser	N/A	N/A	Cookie remains (persistent)	Browser closed
7	User returns	Cookie remember_token=abc123	Cookie valid?	N/A	Auto-login user
8	Grant access	N/A	N/A	N/A	User logged in automatically
9	End	N/A	N/A	N/A	Process complete

💡 Process ends after user is auto-logged in or session cookie expires.

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	After Step 5	After Step 7	Final
username	None	'user1'	'user1'	'user1'	'user1'	'user1'	'user1'
remember	False	False	True	True	True	True	True
cookie_set	None	None	None	'remember_token=abc123'	'remember_token=abc123'	'remember_token=abc123'	'remember_token=abc123'
user_logged_in	False	False	False	False	False	True	True

Key Moments - 3 Insights

Why does the cookie persist after closing the browser when 'Remember me' is checked?

Because the cookie is set with a max_age (30 days), making it persistent. See execution_table step 4 where 'remember_token=abc123' is set with max_age.

What happens if 'Remember me' is not checked?

A session cookie is set without max_age, so it expires when the browser closes. This is shown in the else branch in the code and implied in execution_table step 3 'No' branch.

How does the app auto-login the user on return?

The app reads the persistent cookie 'remember_token' and validates it. If valid, it logs in the user automatically as shown in execution_table step 7.

Visual Quiz - 3 Questions

Look at the execution_table at step 4, what cookie is set when 'Remember me' is checked?

A No cookie is set

B 'session=xyz789' session cookie

C 'remember_token=abc123' with 30 days expiry

D 'remember_token=xyz789' session cookie

💡 Hint

Check the 'Cookie Set' column at step 4 in execution_table.

At which step does the user get auto-logged in on return?

A Step 5

B Step 7

C Step 3

D Step 2

💡 Hint

Look for 'Auto-login user' in the 'Output' column of execution_table.

If the 'Remember me' box is not checked, what changes in the cookie behavior?

A A session cookie is set that expires on browser close

B A persistent cookie is still set

C No cookie is set at all

D The cookie expires immediately

💡 Hint

Refer to key_moments about what happens if 'Remember me' is not checked and execution_table step 3.

Concept Snapshot

Remember me functionality in Flask:
- On login, check if 'Remember me' is checked.
- If yes, set a persistent cookie with max_age (e.g., 30 days).
- If no, set a session cookie that expires on browser close.
- On user return, check persistent cookie to auto-login.
- Use cookies to keep user logged in beyond session.

Full Transcript

This visual execution trace shows how a Flask app handles 'Remember me' functionality. When a user logs in, the app checks credentials and whether the 'Remember me' checkbox is selected. If selected, it sets a persistent cookie with a token and a long expiry time. If not, it sets a session cookie that expires when the browser closes. When the user returns, the app checks for the persistent cookie and auto-logs in the user if the token is valid. The execution table details each step, showing actions, conditions, and cookies set. The variable tracker follows key variables like username, remember flag, cookie set, and login status. Key moments clarify common confusions about cookie persistence and auto-login. The quiz tests understanding of cookie setting and login flow. This helps beginners see how 'Remember me' works step-by-step in Flask.

Practice

1. What does the remember=True parameter do when used with login_user() in Flask-Login?

easy

A. Logs the user out immediately after login.

B. Deletes the user's account after login.

C. Prevents the user from logging in.

D. Keeps the user logged in across browser sessions using cookies.

Solution

1. Step 1: Understand the purpose of remember=True

   This parameter tells Flask-Login to store a cookie that keeps the user logged in even after closing the browser.

2. Step 2: Compare with other options

   Options A, C, and D describe actions that do not relate to keeping the user logged in across sessions.

3. Final Answer:

   Keeps the user logged in across browser sessions using cookies. -> Option D

4. Quick Check:

   Remember me = persistent login [OK]

Hint: Remember me means stay logged in after closing browser [OK]

Common Mistakes:

• Thinking remember=True logs out user
• Confusing remember with user registration
• Assuming remember deletes user data

2. Which of the following is the correct way to enable 'remember me' when logging in a user in Flask?

easy

A. login_user(user, remember=1)

B. login_user(user, remember='yes')

C. login_user(user, remember=True)

D. login_user(user, remember='false')

Solution

1. Step 1: Check the correct parameter type

   The remember parameter expects a boolean value, so True is correct.

2. Step 2: Analyze other options

   Options A, B, and D use integer or string instead of boolean, which is incorrect. login_user(user, remember='false') uses string 'false' which is not boolean False.

3. Final Answer:

   login_user(user, remember=True) -> Option C

4. Quick Check:

   Boolean True enables remember me [OK]

Hint: Use boolean True for remember parameter [OK]

Common Mistakes:

• Passing strings instead of boolean
• Using numbers instead of boolean
• Using 'false' string instead of False

3. Given this Flask code snippet:

from flask_login import login_user

user = get_user()
login_user(user, remember=True)

What will happen if the user closes and reopens the browser?

medium

A. The user will remain logged in automatically.

B. The user will be logged out immediately.

C. The user will see an error message.

D. The user must log in again manually.

Solution

1. Step 1: Understand the effect of remember=True

   This stores a cookie that keeps the user logged in even after browser restart.

2. Step 2: Predict user state after reopening browser

   Because of the cookie, the user session persists, so the user stays logged in automatically.

3. Final Answer:

   The user will remain logged in automatically. -> Option A

4. Quick Check:

   Remember me keeps session after browser close [OK]

Hint: Remember me means no login needed after browser restart [OK]

Common Mistakes:

• Assuming user is logged out after closing browser
• Expecting error on reopening browser
• Confusing remember with session timeout

4. What is wrong with this Flask code snippet for 'remember me' functionality?

login_user(user, remember='True')

medium

A. The user variable is not defined.

B. The remember parameter should be a boolean, not a string.

C. login_user does not accept a remember parameter.

D. The code is correct and will work as expected.

Solution

1. Step 1: Check parameter type for remember

   The remember parameter must be a boolean value, not a string.

2. Step 2: Validate other options

   User variable is assumed defined; login_user accepts remember; so only parameter type is wrong.

3. Final Answer:

   The remember parameter should be a boolean, not a string. -> Option B

4. Quick Check:

   remember must be True/False boolean [OK]

Hint: Use True without quotes for remember [OK]

Common Mistakes:

• Passing 'True' as string instead of boolean
• Forgetting to define user variable
• Assuming remember is unsupported

5. You want to implement a logout button that clears the 'remember me' session in Flask. Which code snippet correctly logs out the user and clears the remembered login?

hard

A. from flask_login import logout_user

logout_user()

B. from flask_login import logout_user

logout_user(remember=False)

C. from flask_login import logout_user

logout_user(user)

D. from flask_login import logout_user

logout_user(clear=True)

Solution

1. Step 1: Understand logout_user behavior

   Calling logout_user() clears the user session and any remember me cookies automatically.

2. Step 2: Analyze other options

   logout_user does not take parameters like remember, user, or clear; these cause errors or are ignored.

3. Final Answer:

   from flask_login import logout_user logout_user() -> Option A

4. Quick Check:

   logout_user() clears session and remember me [OK]

Hint: Use logout_user() without parameters to clear remember me [OK]

Common Mistakes:

• Passing parameters to logout_user()
• Not calling logout_user to clear remember me
• Assuming remember must be cleared separately