You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Redis exceptions on open_session make Flask crash painfully, not popping the context correctly (leaking data across requests).
Flask doesn't catch any possible exceptions on the session_interface, resulting in messing up the context.
To reproduce
Set some parameter in flask.g
Initiate RedisSessionInterface on an invalid redis server (redis.exceptions.ConnectionError or any other, we had sometimes Timeout exceptions).
The next requests contains the old flask.g - context not popped
Fix
Ideally Flask uses its interfaces safely - always popping context. Bug created: pallets/flask#2517
Still, I think it would be nice that Flask-Session is safe as well, catching possible redis problems and not letting Flask deal with the exceptions.
Regarding handling in flask-session, I think it is better to use SESSION_REDIS = Redis(host='localhost', port=6379, retry=retry, retry_on_error=[BusyLoadingError, ConnectionError, TimeoutError])
Redis exceptions on open_session make Flask crash painfully, not popping the context correctly (leaking data across requests).
Flask doesn't catch any possible exceptions on the session_interface, resulting in messing up the context.
To reproduce
Fix
Ideally Flask uses its interfaces safely - always popping context. Bug created: pallets/flask#2517
Still, I think it would be nice that Flask-Session is safe as well, catching possible redis problems and not letting Flask deal with the exceptions.
Environment
Python version: 2.7.6
Flask version: 0.10.1
Werkzeug version: 0.11.11
Flask-Session: 0.3.1
The text was updated successfully, but these errors were encountered: