Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

FlaskLoginClient does not work for @fresh_login_required views #586

Closed
PoshAlpaca opened this issue May 18, 2021 · 0 comments
Closed

FlaskLoginClient does not work for @fresh_login_required views #586

PoshAlpaca opened this issue May 18, 2021 · 0 comments

Comments

@PoshAlpaca
Copy link

Describe the bug
When attempting to access a view that is protected by the @fresh_login_required decorator via FlaskLoginClient a 401 error is raised, even though the session's _fresh property is set to True by FlaskLoginClient.

To Reproduce
Steps to reproduce the behavior:

  1. Create a Flask view function decorated with @fresh_login_required
  2. Create a FlaskLoginClient and try to access /myview:
app.test_client_class = FlaskLoginClient
with app.test_client(user=my_user_obj, fresh_login=True) as client:
    response = client.get("/myview")
    assert response.status_code == 200 # fails because 401 != 200
  1. 401 Unauthorized is returned even though session["_fresh"] is set to True

Expected behavior
The view function should be accessible, i.e. return a 200 OK because we have specified that the current session should be fresh.

Speculative explanation
FlaskLoginClient doesn't set _id on the session so when the fresh_login_required function accesses current_user on line 309 in utils.py, LoginManager._load_user is called which runs LoginManager._session_protection_failed which cannot find the _id property on session thus setting sess["_fresh"] = False.

See also issue #569 which discusses the behavior of invalidating a session when _id is not found.

@github-actions github-actions bot locked and limited conversation to collaborators Apr 14, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants