This is an obscure issue in the least, and I'm sure I'm looking over something. I'm running a Flask application that stores very basic strings in user sessions using flask.session
.
The server is setup to go through Nginx -> uwsgi (emperor mode) -> Flask application
.
The following is a decorator I use on certain @app.route()
wrapped functions for requests, so that way I can verify that the information is in the session:
def verify(method):
@wraps(method)
def wrapper(*args, **kwargs):
data = flask.request.get_json() or flask.request.form or flask.request.args
if 'name' in flask.session:
return method(*args, **kwargs)
elif data.get("name"):
if is_user(data.get("name")):
flask.session['name'] = data.get("name")
return method(*args, **kwargs)
return flask.jsonify(success=False, message='Incorrect information supplied.')
else:
return flask.jsonify(success=False, message='Not all information supplied.')
return wrapper
An example way that I'm utilizing the above, as well as accessing the session:
@app.route('/api/user')
@verify
def api_route():
# .. misc code here ..
return flask.jsonify(success=True, user=flask.session['name'])
Now.. lets say I access using Chrome, and ensure the session is setup. Now, I go to some random server, and curl the specific api endpoint, and it's pulling the session that my browser shares:
[~]$ curl -4s https://domain.com/api/user
{
"success": true,
"user": "liam"
}
I believe this may be due to Nginx and/or uwsgi, but I'm not sure for certain. I've used the same configuration for Nginx and various other sites and I've never seen an issue like this.
Seen it before? Is there another way I should be working with the session? Any other information I can provide to point me in the correct location?
EDIT:
I've tested this without Nginx and uwsgi and the issue still occurs. Nothing acting as a middle-man.