Protect Views with login_required
Gate routes and redirect anonymous users.
Protect Views with login_required is a free Flask Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Flask Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Some Pages Need a Guard
A dashboard or settings page should never load for a stranger. You protect such routes so only a logged-in user can reach them.
The login_required Decorator
Flask-Login hands you a one-line gate: the login_required decorator. Stack it on any view and anonymous visitors get bounced away.
from flask_login import login_requiredApply It to a Route
Place login_required just below the route decorator. Order matters, so the auth check wraps the view that Flask actually calls.
@app.route("/dashboard")
@login_required
def dashboard():
return "Welcome back"What Happens to Strangers
If an anonymous user hits a guarded route, Flask-Login does not show the page. It redirects them to your login view instead.
Tell It Where Login Lives
For the redirect to work, set login_view on the manager. Give it the endpoint name of your login route so it knows the target.
login_manager.login_view = "login"The next Parameter
Flask-Login appends a next query parameter to the login URL. It remembers where the user wanted to go before being redirected.
Send Them Back After Login
In your login view, read request.args.get for next and redirect there once they sign in. The user lands exactly where they started.
dest = request.args.get("next") or url_for("index")
return redirect(dest)Customize the Message
You can set login_message to control the flash shown when access is denied. A friendly note beats a confusing silent redirect.
login_manager.login_message = "Please log in first."Use current_user Inside
Inside a guarded view you can trust current_user is real and authenticated. No need to re-check, the decorator already did it.
@login_required
def profile():
return current_user.emailProtecting Many Routes
For a whole admin area you can apply login_required per view, or attach it to a blueprint's before_request so every route is covered.
Beyond Just Logged In
login_required only checks that someone is authenticated. For role checks like admin-only, you add your own logic on top inside the view.
Quick Check
An anonymous visitor opens a login_required route. What does Flask-Login do?
Recap
You guarded routes with login_required, set login_view for redirects, and used next to return users home. Your protected pages are locked down. 🛡️
Frequently asked questions
Is the “Protect Views with login_required” lesson free?
Yes — the full text of “Protect Views with login_required” is free to read here on the web, and the Flask Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Flask Academy course, upgrade to CoddyKit PRO.
What will I learn in “Protect Views with login_required”?
Gate routes and redirect anonymous users. You practise Flask Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Flask Academy?
No prior experience is required. Flask Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Protect Views with login_required” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Flask Academy lesson?
Yes. Every Flask Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Hash Passwords, Never Store Plaintext
- User Loader and the UserMixin
- login_user, logout_user, and Sessions
- Protect Views with login_required