---
title: "GET login form and/or user information"
method: GET
path: "/login"
---

# GET login form and/or user information

`GET /login`

## Response `200`

Login form or user information. The JSON response will always carry the csrf_token information. If SECURITY_CSRF_COOKIE_NAME is set then a cookie with the csrf token will be set. If the caller is already authenticated, then additional information is returned for JSON requests. This can be very useful for single-page applications where during a force refresh, all state is lost. By performing this GET, the session cookie will authenticate the user and the response will contain user information.

- object
  - `meta` object, required
    - `code` integer, required — Http status code
  - `response` object, required
    - `user` object — By default an empty dictionary is returned. However by overriding _User::get_security_payload()_ any attributes of the User model can be returned.
    - `csrf_token` string — Session CSRF token
    - `identity_attributes` string[] — List of allowable identities

## Other responses

- `302` — Response when already logged in (non-JSON request)

## Changes

- **2024-06-13** `2753edbb97e1` — 2 info
  - added `#/components/schemas/DefaultJsonResponse` to the response body `allOf` list for the response status `200`
  - removed `#/components/schemas/BaseJsonResponse` from the response body `allOf` list for the response status `200`
- **2022-05-26** `e230de7110c4` — 2 warning, 1 info
  - removed the optional property `allOf[subschema #2]/response/csrf_token` from the response with the `200` status
  - removed the optional property `allOf[subschema #2]/response/user` from the response with the `200` status
  - added the optional property `allOf[subschema #2]/response/identity_attributes` to the response with the `200` status
- **2022-04-11** `afed188e0556` — 1 breaking, 2 warning, 1 info
  - the response's body type/format changed from `object`/`` to ``/`` for status `200`
  - removed the optional property `csrf_token` from the response with the `200` status
  - removed the optional property `user` from the response with the `200` status
  - added `#/components/schemas/BaseJsonResponse, subschema #2` to the response body `allOf` list for the response status `200`
- **2021-01-05** `0bfdf8845acd` — 1 warning
  - deleted the `query` request parameter `include_auth_token`
- **2020-08-31** `a06cc5a6dff4` — 1 warning
  - removed the optional property `user/authentication_token` from the response with the `200` status

[Full history](https://skmtc.dev/pallets-eco/apis/flask-security-external-api/changes/login/get.md)

---

[API](https://skmtc.dev/pallets-eco/apis/flask-security-external-api.md) · [All operations](https://skmtc.dev/pallets-eco/apis/flask-security-external-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/pallets-eco/flask-security-external-api/revisions/ee92f388dafa/schema)