A browser cannot show a page—or submit a login form—without asking a server to act. An HTTP request message carries that request from the client. The server processes it and returns a response, often an HTML page that the browser renders. section 6.2.1 section 6.3
The first line identifies a method and a path. In `GET /path_part/index.html HTTP/1.1`, GET asks for a resource; the request also includes a Host header and an Accept header. A rendered page may prompt further requests for its CSS and JavaScript files. section 6.3
POST is useful when a form sends user-entered data for the server to process. A login form, for example, submits an email address and password with `method="POST"`. The receiving handler can validate those values before looking up a user and checking the password. Treat the request as the start of that workflow, not as proof that the submitted values are valid. section 8.2.2
One URL, two jobs
A password-reset endpoint can respond to GET by presenting a form, then respond to POST when the user submits it. After a reset-token link leads to the new-password form, its POST handler verifies the token, finds the user, validates the form, and saves the changed password. section 9.3
{% extends "base.html" %} #1
{% import "macros.jinja" as macros %} #2
{% block content %}
<div class="login-wrapper mx-auto mt-3">
<div class="container login">
<form method="POST" novalidate>
<div class="card">
<h5 class="card-header">
User Login
</h5>
<div class="card-body">
<div class="card-text">
{{form.csrf_token}} #3
<div #4
class="form-floating mb-3"> #4
{{form.email( #4
class_="form-control")}} #4
{{form.email.label( #4
class_="form-label")}} #4
{{macros. #4
validation_errors(form.email.errors)}} #4
</div> #4
<div class="mb-3"> #5
{{form.password( #5
class_="form-control")}} #5
{{form.password.label( #5
class_="form-label")}} #5
{{macros.validation_errors(form.password.errors)}} #5
</div> #5
<div class="mb-3"> #6
{{form.remember_me}} #6
{{form.remember_me.label( #6
class_="form-check-label")}} #6
</div> #6
</div>
</div>
<div class="card-footer text-end">
{{form.cancel(
class_="btn btn-warning me-2")}} #7
{{form.submit(
class_="btn btn-primary")}} #8
</div>
</div>
</form>
</div>
</div>
{% endblock %}
{% block styles %}
{{ super() }}
<link rel="stylesheet" type="text/css"
href="{{ url_for('.static',
filename='css/login.css') }}" />
{% endblock %}
The login template’s `method="POST"` shows where a browser form is configured to submit a POST request; its form fields and CSRF token are part of the application’s form-handling workflow. section 8.2.2
