2

This is an obscure issue in the least, and I'm sure I'm looking over something. I'm running a Flask application that stores very basic strings in user sessions using flask.session.

The server is setup to go through Nginx -> uwsgi (emperor mode) -> Flask application.

The following is a decorator I use on certain @app.route() wrapped functions for requests, so that way I can verify that the information is in the session:

def verify(method):
    @wraps(method)
    def wrapper(*args, **kwargs):
        data = flask.request.get_json() or flask.request.form or flask.request.args
        if 'name' in flask.session:
            return method(*args, **kwargs)
        elif data.get("name"):
            if is_user(data.get("name")):
                flask.session['name'] = data.get("name")
                return method(*args, **kwargs)
            return flask.jsonify(success=False, message='Incorrect information supplied.')
        else:
            return flask.jsonify(success=False, message='Not all information supplied.')
    return wrapper

An example way that I'm utilizing the above, as well as accessing the session:

@app.route('/api/user')
@verify
def api_route():
    # .. misc code here ..
    return flask.jsonify(success=True, user=flask.session['name'])

Now.. lets say I access using Chrome, and ensure the session is setup. Now, I go to some random server, and curl the specific api endpoint, and it's pulling the session that my browser shares:

[~]$ curl -4s https://domain.com/api/user
{
  "success": true,
  "user": "liam"
}

I believe this may be due to Nginx and/or uwsgi, but I'm not sure for certain. I've used the same configuration for Nginx and various other sites and I've never seen an issue like this.

Seen it before? Is there another way I should be working with the session? Any other information I can provide to point me in the correct location?

EDIT:

I've tested this without Nginx and uwsgi and the issue still occurs. Nothing acting as a middle-man.

0

1 Answer 1

2

So, it looks like I found the solution. Further in my code, not mentioned above, I have the following:

@app.route('/unset')
def unset_user():
    flask.session = {}
    return flask.jsonify(success=True)

It looks as though when you set flask.session to a dictionary, this behavior occurs. I should have been using flask.session.clear() all along.

Testing it now and everything looks awesome. Yay!

1
  • Thanks! this helped me to retain as a "global" variable a special "public" object expensive to create, since I don't need "real" sessions for my app, this was a solution.
    – anibal
    Mar 13 at 21:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.