# How to Integrate User Sessions and Authentication with Flask-Login: A Complete Guide > Learn to integrate user sessions and authentication with Flask-Login. Secure your Flask app using user_id in session and user_loader callbacks for persistent authentication. - Repository: [Pallets/flask](https://github.com/pallets/flask) - Tags: how-to-guide - Published: 2026-02-16 --- **Flask-Login integrates with Flask's native signed-cookie session system by storing the user identifier in `session["user_id"]`, which the `LoginManager` reads on each request to load the user object via your `user_loader` callback, enabling persistent authentication across requests without modifying Flask's core session architecture.** To properly integrate user sessions and authentication with Flask-Login for your web application, you need to understand how Flask's session system works under the hood and how Flask-Login leverages it. The Flask framework (pallets/flask) provides a secure, signed-cookie based session mechanism that Flask-Login extends to persist user identity across requests. ## Understanding Flask's Native Session Architecture Flask's session system stores data client-side in a signed cookie that is cryptographically secured against tampering. This design eliminates the need for server-side storage while maintaining data integrity. ### How Flask Stores Session Data in Signed Cookies The core implementation resides in [`src/flask/sessions.py`](https://github.com/pallets/flask/blob/main/src/flask/sessions.py), specifically within the **`SecureCookieSessionInterface`** class (lines 98-118). This interface handles the creation, signing, and verification of session cookies using your application's **`SECRET_KEY`**. When a session is created, Flask instantiates a **`SecureCookieSession`** object (lines 52-73), which inherits from `CallbackDict` and **`SessionMixin`**. This object tracks modification state through flags like `modified`, `accessed`, and `permanent`, ensuring Flask only sends updated cookies when necessary. ### The Session Interface and Global Access When a request begins, Flask calls **`SessionInterface.open_session`** to deserialize the cookie from the incoming request into a dictionary-like object that mixes in **`SessionMixin`** (lines 24-45 in [`src/flask/sessions.py`](https://github.com/pallets/flask/blob/main/src/flask/sessions.py)). This object is then exposed globally through the **`session`** proxy defined in [`src/flask/globals.py`](https://github.com/pallets/flask/blob/main/src/flask/globals.py) (lines 60-62). The `session` object behaves like a standard Python dictionary, allowing you to store and retrieve data across requests: ```python from flask import session @app.route('/set') def set_data(): session['user_preference'] = 'dark_mode' return 'Preference saved' @app.route('/get') def get_data(): preference = session.get('user_preference', 'light_mode') return f'Current mode: {preference}' ``` ## Integrating Flask-Login for User Authentication Flask-Login is an extension that manages user authentication by leveraging Flask's existing session system. Rather than implementing its own storage mechanism, it stores the authenticated user's identifier within the standard Flask session. ### Storing User Identity in the Session When you call **`login_user(user, remember=True)`**, Flask-Login writes the user's identifier (by default `user_id`) into the Flask session at the key `session["user_id"]`. This operation utilizes the standard `session` object from [`flask/globals.py`](https://github.com/pallets/flask/blob/main/flask/globals.py), meaning the data is serialized into the signed cookie by `SecureCookieSessionInterface` when the request completes. When **`logout_user()`** is called, it removes `user_id` from the session dictionary and clears any remember-me cookies managed separately by Flask-Login. ### Loading Users with the user_loader Callback On every request, Flask-Login's **`LoginManager`** invokes the **`user_loader`** callback you register to retrieve the user object. This callback receives the `user_id` stored in the session and must return the corresponding user object or `None`: ```python from flask_login import LoginManager, UserMixin login_manager = LoginManager(app) class User(UserMixin): def __init__(self, id): self.id = id # Simulated database users = {'alice': User('alice'), 'bob': User('bob')} @login_manager.user_loader def load_user(user_id): # Return User object or None return users.get(user_id) ``` The loaded user is then exposed through the **`current_user`** proxy, which behaves similarly to the `session` proxy in [`flask/globals.py`](https://github.com/pallets/flask/blob/main/flask/globals.py). ### Protecting Routes with login_required Flask-Login provides the **`@login_required`** decorator to restrict access to authenticated users. This decorator checks `current_user.is_authenticated`; if false, it redirects to the view specified by **`login_manager.login_view`**: ```python from flask_login import login_required, current_user @app.route('/dashboard') @login_required def dashboard(): return f'Welcome, {current_user.id}!' ``` ## Complete Implementation Example Below is a minimal but complete Flask application demonstrating the integration of Flask-Login with Flask's default session handling: ```python from flask import Flask, render_template_string, request, redirect, url_for, flash from flask_login import LoginManager, UserMixin, login_user, logout_user, \ login_required, current_user app = Flask(__name__) app.secret_key = "replace-with-a-random-secret" # needed for signed cookies # ------------------------------------------------- # 1. Initialise Flask-Login # ------------------------------------------------- login_manager = LoginManager(app) login_manager.login_view = "login" # where @login_required redirects login_manager.session_protection = "strong" # optional security # ------------------------------------------------- # 2. Provide a user class (must implement get_id()) # ------------------------------------------------- class User(UserMixin): """Simple User model for demonstration.""" _users = { "alice": {"id": "alice", "password": "wonderland"}, "bob": {"id": "bob", "password": "builder"}, } def __init__(self, username): self.id = username @classmethod def authenticate(cls, username, password): data = cls._users.get(username) if data and data["password"] == password: return cls(username) return None # ------------------------------------------------- # 3. Load a user from the session # (Flask-Login calls this on each request) # ------------------------------------------------- @login_manager.user_loader def load_user(user_id): # Return a User object or None if user_id in User._users: return User(user_id) return None # ------------------------------------------------- # 4. Login view # ------------------------------------------------- @app.route("/login", methods=["GET", "POST"]) def login(): if request.method == "POST": username = request.form["username"] password = request.form["password"] user = User.authenticate(username, password) if user: login_user(user, remember=True) # writes user_id into Flask session flash("Logged in!") return redirect(url_for("protected")) flash("Invalid credentials") return render_template_string( """
""" ) # ------------------------------------------------- # 5. Protected view – requires a valid session # ------------------------------------------------- @app.route("/secret") @login_required def protected(): return f"Hello, {current_user.id}! This is a protected page." # ------------------------------------------------- # 6. Logout view # ------------------------------------------------- @app.route("/logout") @login_required def logout(): logout_user() # clears session["user_id"] flash("Logged out") return redirect(url_for("login")) # ------------------------------------------------- # 7. Run the app (development only) # ------------------------------------------------- if __name__ == "__main__": app.run(debug=True) ``` **What happens under the hood** When `login_user()` is called, it stores `user.id` in `flask.session["user_id"]`. Because Flask's default `SecureCookieSessionInterface` signs the entire session dictionary using your `SECRET_KEY`, the cookie cannot be forged without knowing the secret key. On each subsequent request, Flask-Login's internal `LoginManager._load_user_from_request` reads that key, invokes your `load_user` callback, and sets `flask_login.current_user` to the loaded `User` object. The `@login_required` decorator then checks `current_user.is_authenticated` to enforce access control. ## Customizing Session Storage for Scalability While Flask-Login works seamlessly with Flask's default cookie-based sessions, you may need server-side storage for larger session data or enhanced security. Because Flask-Login only manipulates the `session` dictionary, it remains compatible with any custom `SessionInterface`. Here is an example implementation using Redis for server-side session storage: ```python from flask.sessions import SessionInterface, SessionMixin from redis import Redis import pickle from uuid import uuid4 class RedisSession(dict, SessionMixin): pass class RedisSessionInterface(SessionInterface): def __init__(self, redis_client: Redis): self.redis = redis_client def open_session(self, app, request): sid = request.cookies.get(app.session_cookie_name) if not sid: return RedisSession() data = self.redis.get(sid) return RedisSession(pickle.loads(data)) if data else RedisSession() def save_session(self, app, session, response): if not session: response.delete_cookie(app.session_cookie_name) return sid = session.get("_id") or uuid4().hex self.redis.set(sid, pickle.dumps(dict(session))) response.set_cookie(app.session_cookie_name, sid, httponly=app.config["SESSION_COOKIE_HTTPONLY"]) ``` Assign this interface to your application: ```python app.session_interface = RedisSessionInterface(Redis()) ``` Flask-Login continues to function unchanged because it relies only on the dictionary-like behavior of the `session` object, not the underlying storage mechanism. ## Summary - **Flask's session system** uses `SecureCookieSessionInterface` in [`src/flask/sessions.py`](https://github.com/pallets/flask/blob/main/src/flask/sessions.py) to store data in cryptographically signed cookies, accessible globally via the `session` proxy in [`src/flask/globals.py`](https://github.com/pallets/flask/blob/main/src/flask/globals.py). - **Flask-Login integration** works by storing the user identifier in `session["user_id"]` via `login_user()`, then loading that user on subsequent requests through your `user_loader` callback. - **Security features** include `session_protection="strong"` to detect session tampering, and the requirement of `SECRET_KEY` to prevent cookie forgery. - **Extensibility** allows you to replace `SecureCookieSessionInterface` with server-side storage (like Redis) without modifying Flask-Login code, as both systems only require the standard `session` dictionary interface. ## Frequently Asked Questions ### How does Flask-Login store user sessions? Flask-Login stores the authenticated user's identifier (by default the `user_id`) inside Flask's standard `session` dictionary at the key `"user_id"`. When you call `login_user(user)`, it writes to `flask.session["user_id"]`, which Flask then serializes into a signed cookie using `SecureCookieSessionInterface`. On subsequent requests, Flask-Login reads this value and passes it to your `user_loader` callback to reconstruct the user object. ### What is the difference between Flask session and Flask-Login? Flask's session is a general-purpose mechanism for storing arbitrary data across requests using signed cookies (implemented in [`src/flask/sessions.py`](https://github.com/pallets/flask/blob/main/src/flask/sessions.py)). Flask-Login is an extension that specifically manages user authentication state by leveraging Flask's session to store only the user identifier. While Flask's session can hold any data, Flask-Login adds the `current_user` proxy, `login_required` decorator, and user loading callbacks to provide a complete authentication framework. ### How do I make sessions permanent with Flask-Login? To make sessions persist beyond the browser session, pass `remember=True` to `login_user(user, remember=True)`. This sets the `permanent` flag on the Flask session and creates a separate, long-lived remember-me cookie managed by Flask-Login. Additionally, you should configure `PERMANENT_SESSION_LIFETIME` in your Flask config to control the expiration duration. When `session_protection="strong"` is enabled, Flask-Login will automatically log out users if their session appears tampered with or if their IP address or user agent changes significantly. ### Can I use server-side sessions with Flask-Login? Yes, Flask-Login works seamlessly with server-side session storage because it only interacts with the `session` dictionary interface. You can replace Flask's default `SecureCookieSessionInterface` with a custom implementation (such as one using Redis or Memcached) by assigning it to `app.session_interface`. As long as your custom interface provides the standard `open_session` and `save_session` methods and returns a dictionary-like object, Flask-Login will continue to store and retrieve `user_id` without any code changes.