0

im trying to build an flask application with user authentication. each user has different pages to be shown. the issue im facing is whenever user A logs in his username is saved in session variable and i use this to prevent users toggling through url without logging in first. but whenever user B logs in,user A is able to see what user B can. the previous session data is being over written. it would amazing if anyone can let me know how do i declare another session each time a new user walks in.

from flask import Flask,render_template,redirect,session,request,g,make_response,url_for
import psycopg2
import os
appt = Flask(__name__)
appt.secret_key= os.urandom(16)

conn=psycopg2.connect( database="one",user="postgres",password="0000",host="localhost",port="5432" )

cursor = conn.cursor()
cursor.execute("select username from use") 
us=cursor.fetchall()
cursor.execute("select password from use")
psw= cursor.fetchall()

i use the above database data for user authentication

@appt.route('/',methods=['GET','POST'])
def index():
    if request.method=='POST':
        global user_name        
        user_name=request.form['username'] # make it global
        pass_word=request.form['password']     
        for i in range(len(us)):
            if user_name in us[i][0]:                    
                new=psw[i][0]                                      
                if new==pass_word:
                    print(session.get('user'))
                    if 'user' not in session:
                        print('new user')
                        user = request.form['username'] # setting user to cookie with userid: username
                        resp = make_response(render_template('monitor.html'))
                        resp.set_cookie('userID', user)  # setting a cookie
                        print(request.cookies.get('userID'))             
                        return resp
                    else:
                        print('old user')
                        return session.get('user')   
        else:
            return render_template('login.html',info="invalid user")                                 
    return render_template('login.html')   
 @appt.route('/logout', methods=['GET', 'POST'])
    def logout(): 
        print("hello")  
        if g.user:
            if request.method == 'GET':
                print("hello")
                print(session['user'][0])
                session.pop('user',None)       
            return render_template("login.html")
        else:
            return redirect("monitor.html")    
    
    @appt.before_request
    def before_request():
        #g.user=None
        if 'user' in session:
            g.user = session['user']
    
    if __name__ == '__main__':
        appt.run(debug=True)
kirti
  • 1
  • 1
  • standard Flask session is data which is stored in cookie file of browser, when http send to your app data from the cookie file is sent as well, so there is no second session, but there are some logic problems in your code. – Artiom Kozyrev Oct 26 '20 at 08:26
  • so are you saying this app cannot be used by multiple users as of now? if yes could you please direct me on what can e used instead? – kirti Oct 26 '20 at 10:52
  • the way to work is to take username from session, then request your db to get data you need based on username – Artiom Kozyrev Oct 26 '20 at 11:02
  • but the reason im storing the user name after authenticating is to use this as a filter to prevent user from accessing other pages without logging in first. i store session data in global variable g to do so – kirti Oct 26 '20 at 11:20
  • actually in is not necessary to store data from session in g, but there can't be any second session, there is only one session in one trhead – Artiom Kozyrev Oct 26 '20 at 11:30

0 Answers0