I'm a little confused about something. login()

@app.route("/login", methods=["GET", "POST"])
def login():
    """Log user in."""

    # forget any user_id

    # if user reached route via POST (as by submitting a form via POST)
    if request.method == "POST":

        # ensure username was submitted
        if not request.form.get("username"):
            return apology("must provide username")

        # ensure password was submitted
        elif not request.form.get("password"):
            return apology("must provide password")

        # query database for username
        rows = db.execute("SELECT * FROM users WHERE username = :username", username=request.form.get("username"))

        # ensure username exists and password is correct
        if len(rows) != 1 or not pwd_context.verify(request.form.get("password"), rows[0]["hash"]):
            return apology("invalid username and/or password")

        # remember which user has logged in
        session["user_id"] = rows[0]["id"]

        # redirect user to home page
        return redirect(url_for("index"))

    # else if user reached route via GET (as by clicking a link or via redirect)
        return render_template("login.html")

I don't understand why the session is cleared at the very top? If the code is read from top to bottom, it would be erased before you use it? Can someone explain why session.clear() is at the very top, instead at the bottom?


Putting it at the bottom would be bad. From the spec:

... notice how login "remembers" that a user is logged in by storing his or her user_id, an INTEGER, in session. That way, any of this file’s routes can check which user, if any, is logged in. Meanwhile, notice how logout simply clears session, effectively logging a user out.

session.clear() "effectively" logs the user out. It (session data, specifically session["user_id"]) is not "used" in the login route, it is set there.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .