I would like to ask if this code is safe for user to log-in (save ID to session) and check if user is log-in when visiting site (Dashboard).

@ll.route('/login', methods=['GET', 'POST'])
def LogIn():
  if request.method == 'GET':
     return render_template('login')
  elif request.method == 'POST':
     ....Checking password, hashing.....
     session.pop('User', None)
     session['User'] = id_User

     return redirect(url_for('LogINR.Dash'))
     return 'Method Not Allowed', 405

def Dashboard():
  if g.User:
    return render_template('dash.html')
  return redirect(url_for('LogINR.LogIn'))

def before_request():
    g.User = None
    if 'User' in session:
        g.User = session['User']
  • 5
    \$\begingroup\$ Can you include all the relevant code into the question? Namely what you left out as "checking password, hashing" and the various undefined symbols (g, session, and the various imports from flask). \$\endgroup\$ – 301_Moved_Permanently May 14 '19 at 9:24