1
\$\begingroup\$

I would like to ask if this code is safe for user to log-in (save ID to session) and check if user is log-in when visiting site (Dashboard).

@ll.route('/login', methods=['GET', 'POST'])
def LogIn():
  if request.method == 'GET':
     return render_template('login')
  elif request.method == 'POST':
     ....Checking password, hashing.....
     session.pop('User', None)
     session['User'] = id_User

     return redirect(url_for('LogINR.Dash'))
  else:
     return 'Method Not Allowed', 405

@ll.route('/dash')
def Dashboard():
  if g.User:
    return render_template('dash.html')
  return redirect(url_for('LogINR.LogIn'))

@mod.before_request
def before_request():
    g.User = None
    if 'User' in session:
        g.User = session['User']
\$\endgroup\$

closed as off-topic by Mathias Ettinger, yuri, Toby Speight, pacmaninbw, ferada May 15 at 21:43

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Lacks concrete context: Code Review requires concrete code from a project, with sufficient context for reviewers to understand how that code is used. Pseudocode, stub code, hypothetical code, obfuscated code, and generic best practices are outside the scope of this site." – Mathias Ettinger, yuri, Toby Speight, pacmaninbw, ferada
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 5
    \$\begingroup\$ Can you include all the relevant code into the question? Namely what you left out as "checking password, hashing" and the various undefined symbols (g, session, and the various imports from flask). \$\endgroup\$ – Mathias Ettinger May 14 at 9:24