Flask-Login

Flask-Login is the standard session-management extension for Flask. Flask itself ships no auth system at all, so Flask-Login fills that specific gap: it tracks which user is logged in across requests, manages remember-me cookies, and provides a login_required decorator to protect views.

It deliberately does not handle password hashing, user storage, or registration — those are left to the app (often paired with a package like Flask-Security or Authlib for OAuth). That minimalism mirrors Flask's own philosophy: Flask-Login is close to the default choice once a Flask project needs sessions at all, but it is one building block, not a complete auth solution.

It works entirely through Flask's own signed session cookie — no server-side session store is required unless the app already uses one — and the optional remember-me cookie is signed with the app's own secret key rather than a separate token system. Because Flask-Login stays silent on passwords, it is routinely paired with Werkzeug's security helpers or Flask-Bcrypt for hashing, and with Flask-WTF for the login form itself.