Let’s start by discussing the concept of “session management.” Imagine that when you browse products, add items to your cart, and checkout on an e-commerce platform, you don’t need to log in again for each step—this is session management at work. Its core goal is to let the server remember the user’s state, maintaining the login status even when navigating between pages.
Session Management in Flask¶
In Flask, session management is primarily implemented through the built-in session object. The session is essentially a “temporary storage” that preserves user information (e.g., login status) across multiple requests. It relies on cookies (stored in the user’s browser) and a secret key to encrypt data, ensuring security.
Preparation: Installation and Basic Configuration¶
First, ensure Flask is installed:
pip install flask
Initialize the Flask app and set a secret key (the key must be kept confidential; this is just an example; use a complex random string in production):
from flask import Flask, session, redirect, url_for, request, render_template
app = Flask(__name__)
app.secret_key = 'your_own_secret_key_here' # Important! For encrypting session data; MUST be changed
Implementing User Login State Maintenance¶
We achieve this in three steps: login verification, maintaining login status, and logging out.
1. Login Verification: Retrieve User Info and Set Session¶
Create a login page (simple HTML form) that validates credentials upon submission. If successful, store the user info in session.
login.html (place in the templates folder):
<!DOCTYPE html>
<html>
<head>
<title>Login</title>
</head>
<body>
<h1>User Login</h1>
<form method="post">
<label>Username:</label>
<input type="text" name="username" required><br><br>
<label>Password:</label>
<input type="password" name="password" required><br><br>
<input type="submit" value="Login">
</form>
</body>
</html>
Route Implementation:
@app.route('/login', methods=['GET', 'POST'])
def login():
if request.method == 'POST':
# Get form inputs
username = request.form.get('username')
password = request.form.get('password')
# Simplified validation (replace with database/third-party verification in production)
if username == 'admin' and password == '123456':
# On successful login: store username in session
session['username'] = username
return redirect(url_for('home')) # Redirect to home page
else:
return "Incorrect username or password!"
# For GET requests: render login form
return render_template('login.html')
2. Maintain Login State: Verify Session and Display User Info¶
On the homepage, check if the session contains user info. If yes, show a welcome message; otherwise, redirect to the login page.
Route Implementation:
@app.route('/')
def home():
# Check if username exists in session
username = session.get('username')
if username:
return f"Welcome back, {username}! <br><a href='/logout'>Logout</a>"
else:
return redirect(url_for('login')) # Redirect to login if not logged in
3. Logout: Clear Session¶
When the user clicks “Logout,” remove the user info from session.
Route Implementation:
@app.route('/logout')
def logout():
# Safely remove username from session (avoids KeyError)
session.pop('username', None)
return redirect(url_for('login')) # Redirect to login page
Session Considerations¶
-
Secret Key Security
Thesecret_keyis critical for encryptingsessiondata. Never expose it! In production, store it in environment variables or config files instead of hardcoding. -
Session Expiration
By default,sessionexpires when the browser is closed (“session-level expiration”). To extend it:
from datetime import timedelta
app.permanent_session_lifetime = timedelta(days=1) # Set 1-day expiration
Also set session.permanent = True during login.
- Data Storage Location
sessiondata is stored in the user’s browser cookie (after encryption), while the server only stores the encrypted session ID. Avoid storing sensitive data (e.g., passwords) insession—only non-sensitive identifiers (e.g., username) are safe.
Summary¶
With Flask’s session, you can easily maintain user login status. The core steps are: submit form → verify success → set session → verify session → clear session. After mastering these basics, you can extend functionality (e.g., “Remember Me,” permission control).
Remember: session is a short-term “session memory,” ideal for quick user identity verification. For long-term storage, combine with databases or Redis for persistent solutions.