forms.py

# -*- coding: utf-8 -*-

from flask_wtf import Form
from wtforms import TextField, PasswordField, FileField
from wtforms import validators

from .models import User


class LoginForm(Form):
    username = TextField(u'Username', validators=[validators.required()])
    password = PasswordField(u'Password', validators=[validators.optional()])

    def validate(self):
        check_validate = super(LoginForm, self).validate()

        # if our validators do not pass
        if not check_validate:
            return False

        # Does our the exist
        user = User.query.filter_by(username=self.username.data).first()
        if not user:
            self.username.errors.append('Invalid username or password')
            return False

        # Do the passwords match
        if not user.check_password(self.password.data):
            self.username.errors.append('Invalid username or password')
            return False

        return True

login.html

{% extends "base.html" %}

{% block title %}Flask Login Example{% endblock %}

{% block body %}
    <h1 class="text-center">Flask Login Example</h1>

    <div class="row">
        <div class="col-md-4"></div>
        <div class="col-md-4">
            <form role="form" action="{{ url_for('.login') }}" method="post">
                {{ form.hidden_tag() }}

                <div class="form-group">
                    {{ form.username.label }}
                    {% if form.username.errors %}
                        {% for e in form.username.errors %}
                            <p class="help-block">{{ e }}</p>
                        {% endfor %}
                    {% endif %}
                    {{ form.username(class_="form-control") }}
                </div>
                <div class="form-group">
                    {{ form.password.label }}
                    {% if form.password.errors %}
                        {% for e in form.password.errors %}
                            <p class="help-block">{{ e }}</p>
                        {% endfor %}
                    {% endif %}
                    {{ form.password(class_="form-control") }}
                </div>

                <button type="submit" class="btn btn-primary">Submit</button>
            </form>
        </div>
        <div class="col-md-4"></div>
    </div>
{% endblock %}

main.py

@main.route("/login", methods=["GET", "POST"])
def login():
    form = LoginForm()

    if form.validate_on_submit():
        user = User.query.filter_by(username=form.username.data).one()
        login_user(user)

        session["userid"] = user.get_id()

        flash("Logged in successfully.", "success")
        return redirect(request.args.get("next") or url_for(".home"))

    return render_template("login.html", form=form)