0

I have a Python code with using framework Flask, that check if admin logged (logged = True) to render admin page, if admin is not logged (logged = False), redirecting to login page.

@app.route('/admin_login', methods=['POST', 'GET'])
def admin_login():
    if request.method == 'POST':
        login = request.form['login']
        passsword = request.form['password']

        if (login == 'admin') and (passsword == 'admin_pass'):
            logged = True
            return redirect('/admin_page'), logged
        else:
            return "Wrond login and passsword!"

    else:
        return render_template('admin_login.html')


@app.route('/admin_page')
def admin_page():
    if logged == True:
        return render_template('admin_page.html')
    else:
        return redirect('/admin_login')

But I get an error in if logged == True: - NameError: name 'logged' is not defined. I tried to make logged global but it didn't helped. So how can I make logged defined and use it in function admin_page?

2
  • A global variable in a web server makes no sense. If you had made that work, then if anybody was logged in as an administrator, then anybody else could freely visit /admin_page! Oct 28, 2020 at 13:33
  • I know it, I just want to know how to use returned logged in other func
    – h4cktivist
    Oct 28, 2020 at 13:35

1 Answer 1

2

You should avoid having a global logged_in variable on the server. Then anybody will be allowed to use your website after a successful login! You should use a session variable instead.

Session data is stored on top of cookies and encrypted. For this encryption, a Flask application needs a defined SECRET_KEY. A Session object is also a dictionary object containing key-value pairs.

Add this near the top of your main script if you haven't already got it:

from flask import Flask, session, redirect, url_for, escape, request, flash
app = Flask(__name__)
app.secret_key = 'any random string’

Then change your function admin_login() to set the session variable:

@app.route('/admin_login', methods=['POST', 'GET'])
def admin_login():
    if request.method == 'POST':
        login = request.form['login']
        passsword = request.form['password']

        if not 'logged_in' in session:
            if (login == 'admin') and (passsword == 'admin_pass'):
                session['logged_in'] = True
                return redirect(url_for("admin_page"))
            else:
                flash("Wrong login and passsword!")
                return render_template('admin_login.html')
        else:
            return redirect(url_for("admin_page"))

    else:
        if "logged_in" in session:
            return redirect(url_for("admin_page"))

        return render_template("admin_login.html")

Then change your admin_page() function to check this session variable:

@app.route('/admin_page')
def admin_page():
    if 'logged_in' in session:
        return render_template('admin_page.html')
    else:
        return redirect(url_for('admin_login'))

You would also need a logout end point to pop out the session variable:

@app.route('/logout')
def logout():
   session.pop('logged_in', None)
   return redirect(url_for('index'))

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.