Compare session and user identifiers consistently when resetting a password - #72198
Merged
Merged
Conversation
vincbeck
approved these changes
Aug 28, 2026
potiuk
force-pushed
the
fix-fab-reset-session-invalidation
branch
from
August 28, 2026 14:34
6c81d1d to
7ffd0e3
Compare
…ssword reset_user_sessions() decoded each stored session and compared its _user_id against user.id directly. Flask-Login stores whatever User.get_id() returns, which is a string, while user.id is the integer column, so the comparison was never true and no session was ever deleted. Both sides are now compared as strings, and a session row without a _user_id is skipped rather than matched. The existing test passed because its fixture wrote an integer _user_id into the session row by hand, exercising a comparison that does not occur in practice. It now stores what get_id() returns. Added coverage for sessions written before get_id() returned a string, and for a row carrying no _user_id at all.
potiuk
force-pushed
the
fix-fab-reset-session-invalidation
branch
from
August 28, 2026 20:06
7ffd0e3 to
e83ed55
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
reset_user_sessions()decodes each stored session and compares its_user_idagainstuser.id:Flask-Login stores whatever
User.get_id()returns — a string (models/__init__.py:357) — whileuser.idis the integer column. The comparison is therefore"1" == 1, which is never true, so no session is ever deleted and the password update proceeds independently. With[fab] session_backend=database,provider.yamldocuments that a password reset deletes all sessions for that user; it deletes none.Both sides are now compared as strings, and a row carrying no
_user_idis skipped rather than matched.On the test.
test_reset_user_sessions_deletepassed throughout, because its fixture wrote an integer_user_idinto the session row by hand — exercising a comparison that cannot occur in practice. It now stores whatget_id()returns. Reverting the source change makes all three parametrisations fail (assert 2 == 1), which they did not before. Added coverage for sessions written beforeget_id()returned a string, and for a row with no_user_id.Local: 28 passed in the touched file, 460 across the provider; ruff and mypy clean.
🤖 Generated with Claude Code