Login not logging user in #803
-
I'm working on very old code that was using Flask-Security and I'm attempting to replace it with Flask-Security-Too 5.2.0. I'm stuck in a login loop and am not sure what to debug. I've injected some print statements into the code and validation is passing in I know moving from FS 3.0.0 to FST 5.2.0 is not a drop-in replacement, but can anyone help me know what to look for in troubleshooting so I can determine what to fix? |
Beta Was this translation helpful? Give feedback.
Replies: 2 comments
-
Lots of possibilities - the first thing I would do is look very carefully at the response to /login - and by look carefully - use the browser developer tools to look at the response (rather than just the rendered response). I assume you are getting a 200 response - which of course in form land doesn't mean things worked - there might be field errors. You don't say if you are using the default login form or have your own. CSRF could be the issue - try setting SECURITY_CSRF_IGNORE_UNAUTH_ENDPOINTS=True - so you CSRF won't be checked for /login. Make sure that in your DB the user record has active=True |
Beta Was this translation helpful? Give feedback.
-
It appears that my issue was related to the fs_uniquifier field requirement. I did not have an fs_uniquifier in my table and I tried to shortcut the requirement by modifying my SQLAchemy model to return the id field for fs_uniquifier, but after I actually added an fs_uniquifier field and filled it with data (I used uuid4) then logins started working. |
Beta Was this translation helpful? Give feedback.
Lots of possibilities - the first thing I would do is look very carefully at the response to /login - and by look carefully - use the browser developer tools to look at the response (rather than just the rendered response). I assume you are getting a 200 response - which of course in form land doesn't mean things worked - there might be field errors. You don't say if you are using the default login form or have your own.
CSRF could be the issue - try setting SECURITY_CSRF_IGNORE_UNAUTH_ENDPOINTS=True - so you CSRF won't be checked for /login.
Make sure that in your DB the user record has active=True