url_for()

[wiesson]

I think return redirect(url_for('main.index')) should be correct instead of return redirect('main.index') here?

And further, the /login view could could be extended by the following code:

@auth.route('/login', methods=['GET', 'POST'])
def login():
    if current_user.is_authenticated():
        return redirect(url_for('main.index'))
    form = LoginForm()
    ... 

The successfully logged-in user should not be able to see the login forms again? I don't know, what do you think?

[miguelgrinberg]

Thanks, I have addressed the first problem, which is clearly an omission on my part. Your second suggestion is valid, too, but given that it presents no security risk I'll leave it as is.