login_user, logout_user และเซสชัน

Once a password checks out, you tell Flask-Login the user is signed in by calling login_user. That single call sets up the session for you.

In a login view you find the user, verify the password, then call login_user. After that, redirect them to a real page like the dashboard.

login_user does not save the whole object. It writes the user id into the session cookie, and your user_loader rebuilds the user later.

Pass remember=True to keep the user logged in after the browser closes. Flask-Login sets a long-lived cookie instead of a session-only one.

Anywhere in a view you can read current_user to get the logged-in person. It is a proxy that always points at the active request's user.

If nobody is logged in, current_user is an anonymous user object. Its is_authenticated is False, so you can branch on that safely.

To sign a user out, call logout_user. It clears their id from the session so the next request treats them as anonymous again.

A logout view is tiny: call logout_user, then redirect home. There is no password to check, only the session to clear.

Sessions ride in a signed cookie, so your app needs a SECRET_KEY. Without it, login_user raises an error and nothing works.

Each browser gets its own signed cookie, so two users never see each other's session. Flask-Login keeps them cleanly separated.

In templates you can use current_user too, since Flask-Login injects it. That makes a personalized navbar a one-line job.

A user clicks Log out. Which call ends their session?

You now login_user after a password check, read current_user anywhere, and call logout_user to end a session. A SECRET_KEY ties it together. 🔑