I am using MongoEngine to save userid(primary key), username, role, and password. I have used flask-login. Even after running login_user(user) successfully, the control isn't going inside the function load_user().
This is my User model:
db = MongoEngine()
class User(db.Document, UserMixin):
username = db.StringField(required=True)
role = db.StringField(required=True)
request_pending = db.BooleanField(required=True)
class Meta:
indexes = [
{
'fields': [('username', 1), ('role', 1)],
'unique': True,
}
]
password_hash = db.StringField(required=True)
def check_password(self, password):
return check_password_hash(self.password_hash, password)
def set_password(self, password):
self.password_hash = generate_password_hash(password)
This is my login() function:
@app.route('/api/login', methods=['POST'])
def login():
print("Login Requested")
data = request.json
username = data.get('username')
password = data.get('password')
role = data.get('role')
# check if username+role exists
user = User.objects.filter(username=username, role=role).first()
if user and user.request_pending == False and user.check_password(password):
login_user(user)
session['username'] = username
session['role'] = role
return jsonify({'message': 'User logged in successfully', 'user': username, 'role': role}), 201
elif user and user.request_pending == True:
return jsonify({'error': 'Registration not approved yet'}), 401
else:
return jsonify({'error': 'Invalid username or password'}), 401
This is my logout() function:
@app.route('/api/logout', methods=['POST'])
@login_required
def logout():
logout_user()
session.pop('username', None)
session.pop('role', None)
return jsonify({'message': 'Logged out successfully'}), 201
This is my load_user() function along with the initialisation:
app = Flask(__name__)
app.secret_key = secrets.token_hex(16)
CORS(app, supports_credentials=True)
app.config['MONGODB_SETTINGS'] = {
'host': '<my mongo atlas host>'
}
db.init_app(app)
# set up Flask-Login
login_manager = LoginManager()
login_manager.init_app(app)
# user loader function
@login_manager.user_loader
def load_user(id):
try:
print("Was here 1")
return User.objects.get(_id=id)
except:
print("Was here 2")
return None
When I call login() and logout() respectively, 2 problems:
- Neither Was here 1, nor Was here 2 gets printed indicating that load_user is not called.
- Even after successful login, logout gives 401 error i.e. login_required is not letting control go inside logout()
Output:
10.2.138.51 - - [09/May/2023 13:08:49] "OPTIONS /api/login HTTP/1.1" 200 -
Login Requested
10.2.138.51 - - [09/May/2023 13:08:50] "POST /api/login HTTP/1.1" 201 -
10.2.138.51 - - [09/May/2023 13:08:51] "OPTIONS /api/logout HTTP/1.1" 200 -
10.2.138.51 - - [09/May/2023 13:08:51] "POST /api/logout HTTP/1.1" 401 -
My frontend is on a remote machine with cookies enabled in its browser. I tried turning the debug mode on and off, I also tried passing remember=True to login_user(), but nothing seems to be working. Please help.