---
title: "GET login form and/or user information"
method: GET
path: "/login"
---

# GET login form and/or user information

`GET /login`

## Response `200`

Login form or user information. The JSON response will always carry the csrf_token information. If SECURITY_CSRF_COOKIE_NAME is set then a cookie with the csrf token will be set. If the caller is already authenticated, then additional information is returned for JSON requests. This can be very useful for single-page applications where during a force refresh, all state is lost. By performing this GET, the session cookie will authenticate the user and the response will contain user information.

- object
  - `meta` object, required
    - `code` integer, required — Http status code
  - `response` object, required
    - `user` object — By default an empty dictionary is returned. However by overriding _User::get_security_payload()_ any attributes of the User model can be returned.
    - `csrf_token` string — Session CSRF token
    - `identity_attributes` string[] — List of allowable identities

## Other responses

- `302` — Response when already logged in (non-JSON request)

---

[API](https://skmtc.net/pallets-eco/apis/flask-security-external-api.md) · [All operations](https://skmtc.net/pallets-eco/apis/flask-security-external-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/pallets-eco/flask-security-external-api/versions/5ee7c28d6e1e/schema)