Trust Boundaries@app.route("/login", methods=["POST"])
def do_login():
"""Attempt to verify the username and password supplied by this user."""
username = request.form["username"]
password = request.form["password"]
user = find_user_with_password(username, password)
if not user:
flash("Invalid credentials", "error")
return redirect("/login")
# Don"t write untrusted content to the session until is has been verified.
session["username"] = username
return redirect("/timeline")