Flask-Login: Does not work on local machine but fine on hosting

Question

I have a flask app, and I use flask-login, following tutorials (nothing fancy here)

• works fine on hosting
• works fine on my local MAC computer (at home)
• does not work on my local Linux computer (at office, which may be behind a firewall, but I am able to do port-forwarding and connect to the database)
• does not work on Chrome or Firefox
• does not work if I serve on localhost instead of 127.0.0.1.

from flask.ext.login import LoginManager 

login_manager = LoginManager()
login_manager.session_protection = "strong"
login_manager.init_app(app)
login_manager.login_view = 'login'

def login():
    error = None
    form = LoginForm()

    if request.method == 'POST':
        user = db.users.find_one({"username": form.username.data})
        pass_hash = generate_password_hash(form.password.data)

        if user and User.validate_login( pass_hash,  user['password'] ):
            user_obj = User(user['username'])
            session['logged_in'] = True
            login_user(user_obj,remember=True)
            flash("Logged in successfully", category='success')
            print 'logged in: OK'

            #return redirect(request.args.get("next") or url_for("index"))
            return redirect( url_for("index"))
        error = 'Invalid credentials'
    return render_template('login.html', title='login', **locals())

well, when I enter my password wrong, it gives the "Invalid credentials" error. When I enter my password correctly, I do not see "Logged in successfully" flash, but on console I see "logged in OK". So there is no problem with DB connection. However I am not logged in. For example,

g.user.is_authenticated()

gives false in the template (this occurs only on my local Linux, on the other hand hosting and MAC successfully logs in the user).

Answer 1

Where and how are you saving the session in the browser?

Consider a session stored in a browser cookie for the production domain example.com, which you have also configured locally (by adding an override to your /etc/hosts file).

If your office server is configured to use a different subdomain, for example office.example.com, and REMEMBER_COOKIE_DOMAIN is set to example.com, the office server will not be able to read the cookie. The fix is to use a cross-domain cookie: REMEMBER_COOKIE_DOMAIN=.example.com (note the preceding dot).

Ref: https://flask-login.readthedocs.org/en/latest/#cookie-settings

Answer 2

With sessions come session management...

• Are you using a client-based session management?
  • possible issues with the cookies e.g. cookie size, too much data in cookie
  • possible issues with the server secret key e.g. generating a new secret key each time
• Are you using server-based session management (e.g. flask-kvsession)?
  • possible issues trying to access the same backend as prod e.g. firewall preventing access to a redis server

It is possible that you are trying to store more session data when hitting your dev server (e.g. longer server urls, debug data, etc...), which can be a pain to deal with when session management is done on the client.