Why authentication matters in Flask - Visual Breakdown

Concept Flow - Why authentication matters

User sends request

↓

Check if user is logged in

↓

Show [User logs in

↓

Grant access

↓

Show content

This flow shows how a web app checks if a user is logged in before giving access to protected content.

Execution Sample

Flask

from flask import Flask, session, redirect
app = Flask(__name__)
@app.route('/dashboard')
def dashboard():
    if 'user' in session:
        return 'Welcome!'
    else:
        return redirect('/login')

This Flask code checks if a user is logged in before showing the dashboard or redirecting to login.

Execution Table

Step	Request URL	Session State	Condition ('user' in session)	Action	Output
1	/dashboard	session = {}	False	Redirect to /login	Redirect response
2	/login	session = {}	N/A	Show login form	Login page content
3	POST /login	session = {}	N/A	Set session['user']	User logged in
4	/dashboard	session = {'user': 'alice'}	True	Show dashboard content	Welcome!
5	/dashboard	session = {'user': 'alice'}	True	Show dashboard content	Welcome!

💡 When 'user' is in session, access is allowed; otherwise, redirect to login.

Variable Tracker

Variable	Start	After Step 1	After Step 3	After Step 4	Final
session	{}	{}	{'user': 'alice'}	{'user': 'alice'}	{'user': 'alice'}
condition ('user' in session)	False	False	False	True	True

Key Moments - 2 Insights

Why does the app redirect to login when 'user' is not in session?

Because the condition 'user' in session is False (see execution_table step 1), so the app blocks access to protect content.

What changes in the session after the user logs in?

The session dictionary gets a 'user' key set (step 3), which makes the condition True for future requests.

Visual Quiz - 3 Questions

Look at the execution table, what is the session state at step 4?

A {'user': 'alice'}

B {}

C {'user': 'bob'}

D None

💡 Hint

Check the 'Session State' column at step 4 in the execution_table.

At which step does the condition 'user' in session become True?

A Step 1

B Step 3

C Step 4

D Step 2

💡 Hint

Look at the 'Condition' column in execution_table to see when it changes to True.

If the session never sets 'user', what will happen when accessing /dashboard?

A Show dashboard content

B Redirect to login page

C Show error message

D Crash the app

💡 Hint

Refer to step 1 in execution_table where condition is False and action is redirect.

Concept Snapshot

Authentication flow in Flask:
- Check if 'user' key exists in session
- If yes, allow access to protected pages
- If no, redirect to login page
- After login, set 'user' in session
- Protects content from unauthorized access

Full Transcript

This visual shows why authentication matters in a Flask app. When a user requests a protected page like /dashboard, the app checks if the user is logged in by looking for a 'user' key in the session. If the user is not logged in, the app redirects them to the login page. After the user logs in, the app sets 'user' in the session. Then, future requests to /dashboard find 'user' in session and allow access. This protects sensitive pages from unauthorized users.