title: Prevent users from directly accessing url and redirect to login if not logged in Flask
body: <p>so I have a flask Application, where in the home page I am rendering a login page to sign in. After sign in they get a form to fill. I am also using the username value while they sign in later on in the form submit process.
  This is my relevant flask code:</p>
  <pre><code>@app.route('/', methods=['GET', 'POST'])
  def home():
      return render_template('Login_new.html')
      
  @app.route('/login', methods=['POST'])
  def logger():
      if request.method == 'POST':
          global user
          user = request.form['username']
          passwrd = request.form['password']
  
          if (user==&quot;admin&quot;) and (passwrd==&quot;VendorAdmin2021&quot;):
              return redirect(url_for(&quot;admin.index&quot;))
          
          url = &quot;api for authentication&quot;
          response = requests.post(url, json={&quot;username&quot;: user,&quot;password&quot;: passwrd}, verify=False)
          #data = response.json()
          print(response.status_code)
          
          if response.status_code == 200:
              return redirect(url_for(&quot;test&quot;))
          else:
              flash('Wrong')
              return render_template('Login_new.html')
  </code></pre>
  <p>The test url contains the actual form. Here is the Login_new.html file:</p>
  <pre><code>&lt;html&gt;
  
  &lt;head&gt;
    &lt;link rel=&quot;stylesheet&quot; href=&quot;/static/style2.css&quot;&gt;
    
    &lt;title&gt;Sign in&lt;/title&gt;
  &lt;/head&gt;
  
  &lt;body&gt;
    &lt;div class=&quot;main&quot;&gt;
      &lt;p class=&quot;sign&quot; align=&quot;center&quot;&gt;Novartis&lt;/p&gt;
      &lt;form class=&quot;form1&quot; action=&quot;/login&quot; method=&quot;POST&quot; id=&quot;myForm&quot;&gt;
        &lt;input class=&quot;un &quot; type=&quot;text&quot; align=&quot;center&quot; placeholder=&quot;5-2-1 id&quot; name=&quot;username&quot;&gt;
        &lt;input class=&quot;pass&quot; type=&quot;password&quot; align=&quot;center&quot; placeholder=&quot;Password&quot; name=&quot;password&quot;&gt;
        &lt;input type=&quot;submit&quot; value=&quot;Log in&quot; class=&quot;submit&quot;&gt;
           
                  
      &lt;/div&gt;
  
  &lt;script src=&quot;https://cdn.jsdelivr.net/npm/sweetalert2@10.12.5/dist/sweetalert2.all.min.js&quot;&gt;&lt;/script&gt;
  
  {% with messages = get_flashed_messages() %}
      {% if messages %}
      &lt;script&gt;
        var messages = {{ messages | safe }};
        if (messages==&quot;Wrong&quot;){
            swal.fire({
              title:&quot;Invalid id or password!&quot;,
              text:&quot;Please make sure you are connected to the Company Intranet&quot;,
              icon:&quot;error&quot;,
              closeOnConfirm: false
              });
        }
      &lt;/script&gt;
    {% endif %}
  {% endwith %}
  
  &lt;/body&gt;
  
  &lt;/html&gt;
  </code></pre>
  <p>Everything works fine if the user follows the set procedure, but if they directly enter the test url in the browser, they bypass the login form and subsequently I can't record their username as well.
  Similarly for flask-admin url, if they input the admin credentials, they are redirected to admin url, but if they directly put the admin url, they can access it without any credentials.
  How can I prevent that?</p>
  <p>EDIT:
  I tried using session to achieve the desired result, I tried to follow this <a href="https://techmonger.github.io/10/flask-simple-authentication/" rel="nofollow noreferrer">https://techmonger.github.io/10/flask-simple-authentication/</a> . This is my code now:</p>
  <pre><code>if response.status_code == 200:
              session[&quot;logged_in&quot;] = True
              return redirect(url_for(&quot;test&quot;))
          else:
              flash('Wrong')
              return render_template('Login_new.html')
  </code></pre>
  <p>And in the test url:</p>
  <pre><code>@app.route('/test')
  def test():
      if not session.get('logged_in'):
          return render_template('Login_new.html')
      form = vendorForm()
  </code></pre>
  <p>Now I am getting error that session has no attribute get.
  Please help, I have been stuck on this from way too long</p>