flask current_user.is_authenticated become “True” before login_user() called

Question

Am I the only one experience this problem? login() mechanism I'm using is the most common flask login using login_manager, with User model.

I'm using python v3.8.3, Flask v1.1.2, Flask-Login v0.5.0

The problem is that "current_user.is_authenticated" is always "True" after "POST" request received on /login route, even before login_user() is called !

Then app redirect user to index page, because index route is under @login_required and because login_user() is not yet called, the user is directed to a error page requesting to login.

def login():
    login_form = LoginForm()

    if current_user.is_authenticated:
        return redirect(url_for('index'))
    
    if login_form.validate_on_submit():
        username  = login_form.username.data
        password = login_form.password.data

        # Locate user
        user = User.query.filter_by(username=username).first()

        # Check the password
        if user and verify_pass( password, user.password):
            login_user(user, remember=False)

current_user.is_authenticated is False when "GET" request received for /login route to display the form, but as soon as I click submit, it become True.

Any clue is appreciated.

Quinn Quinn · Accepted Answer · 2020-12-26T08:07:15

now I'm using a workaround, by setting session['USERNAME'] = username after login_user()

Then replace the line "if current_user.is_authenticated:" with

"if 'USERNAME' in session:"

So far, it seems to be a stable solution.

Although I still has no clue why current_user.is_authenticated is always True.

flask current_user.is_authenticated become “True” before login_user() called

1 Answers