I'm a little confused about something. login()
@app.route("/login", methods=["GET", "POST"]) def login(): """Log user in.""" # forget any user_id session.clear() # if user reached route via POST (as by submitting a form via POST) if request.method == "POST": # ensure username was submitted if not request.form.get("username"): return apology("must provide username") # ensure password was submitted elif not request.form.get("password"): return apology("must provide password") # query database for username rows = db.execute("SELECT * FROM users WHERE username = :username", username=request.form.get("username")) # ensure username exists and password is correct if len(rows) != 1 or not pwd_context.verify(request.form.get("password"), rows["hash"]): return apology("invalid username and/or password") # remember which user has logged in session["user_id"] = rows["id"] # redirect user to home page return redirect(url_for("index")) # else if user reached route via GET (as by clicking a link or via redirect) else: return render_template("login.html")
I don't understand why the session is cleared at the very top? If the code is read from top to bottom, it would be erased before you use it? Can someone explain why session.clear() is at the very top, instead at the bottom?