ปกป้องมุมมองด้วย login_required

A dashboard or settings page should never load for a stranger. You protect such routes so only a logged-in user can reach them.

Flask-Login hands you a one-line gate: the login_required decorator. Stack it on any view and anonymous visitors get bounced away.

Place login_required just below the route decorator. Order matters, so the auth check wraps the view that Flask actually calls.

If an anonymous user hits a guarded route, Flask-Login does not show the page. It redirects them to your login view instead.

For the redirect to work, set login_view on the manager. Give it the endpoint name of your login route so it knows the target.

Flask-Login appends a next query parameter to the login URL. It remembers where the user wanted to go before being redirected.

In your login view, read request.args.get for next and redirect there once they sign in. The user lands exactly where they started.

You can set login_message to control the flash shown when access is denied. A friendly note beats a confusing silent redirect.

Inside a guarded view you can trust current_user is real and authenticated. No need to re-check, the decorator already did it.

For a whole admin area you can apply login_required per view, or attach it to a blueprint's before_request so every route is covered.

login_required only checks that someone is authenticated. For role checks like admin-only, you add your own logic on top inside the view.

An anonymous visitor opens a login_required route. What does Flask-Login do?

You guarded routes with login_required, set login_view for redirects, and used next to return users home. Your protected pages are locked down. 🛡️