From what I can tell, you can access the login manager via:
current_app.login_manager
From the example I see in the Flask-Security docs (http://pythonhosted.org/Flask-Security/api.html), it probably responds to the native Flask-Login methods found in that module's docs:
https://flask-login.readthedocs.org/en/latest/#api-documentation
I'm just starting to tinker with Flask-Security myself, and am also annoyed with the lack of examples and documentation, so forgive me if this doesn't help ><
Answer from Chockomonkey on Stack OverflowI am running into some issues with my deployment. I'll give you some background before I explain what I'm trying to do and what I need guidance on.
I have a Flask/AppBuilder app running in a container. This runs fine and works as expected. I want to run it on AWS Lambda behind an API Gateway. So, instead of making a ton of changes to my code (I would still like to run the container in it's current form in a different environment) I am making use of the lambda-web-adapter. This essentially adds a lambda layer which forwards requests that come in to your application. It actually works, kinda. The issue I have is when servicing a request. The way the web adapter works is it boots the app up when initially deploying the function. Then all subsequent invocations are serviced by the already started app.
The problem I have is with the custom security manager I wrote. This looks for a specific header in the request, but the header isn't there. This is probably due to the mapping between API Gateway and the web adapter. Problem is, the authentication header is not present either. This is weird, since when I use one of the built-in security managers, it uses flask-jwt-extended for authentication (not entirely sure how that works. Guessing that it checks for the "authentication" header in the request?) and flask-jwt-extended can find the authorization header just fine. It can't decode the token, hence my custom security manager, but point is, it can find it, and my manager can't.
I've been trying just about everything, but I can't figure it out. I've tried using before_request, but it doesn't have the auth header either.
So, what I'd like to do now is to simply extend the flask-jwt-extended package and override the method(s) that decode the JWT and log the user in. Is this possible? Can you think of why I am experiencing this issue?
I've tried writing some middleware to log the request on each call with call, but that just resulted in an error saying something to the effect of my trying to access request outside of the application context. I don't know why this is, and from the reading I've done, I'm no nearer to understanding it or solving my issue. I've tried doing "from flask import current_app as app" but that didn't work either.
One other approach I did briefly consider was to write a wrapper method. Basically something that would serve as the entry point to my docker container that could get the "event" info from Lambda, then import the flask application and perform a single request against the app. I couldn't get this to work either since running the app blocks the thread and I cannot perform the request. In some sense this approach feels both good and bad. Good since I won't have to run gunicorn, saving on some resources. Bad because for each function invocation I'd have to boot and configure the app which might take longer and result in slower request handling.
Apologies, I know this was a bit of a brain dump, but I've been struggling with this for more than a week. No, Flask/AppBuilder is not something I'm all too familiar with yet.
Thanks for the help in advance!
» pip install Flask-Security
Can someone clarify what's going on between these three extensions?
As I understand it, Flask-Security builds upon Flask-Login by integrating other extensions like passlib, itdangerous, flask-wtf, flask-principal, etc. So Flask-Security trumps Flask-Login in this instance.
Then we have Flask-User, looking at it's github, it also has Flask-Login as a dependency. So this also builds upon Flask-Login.
However, Flask-User had it's last commit 20 days ago, and Flask-Security had it's last commit in October of 2018 and the build is failing. No data for Flask-User status.
The consensus seems to veer towards flask-security. But I'm veering towards Flask-User with the little understanding of the real world differences. I'll be creating all my database records with uuid's as the ID's. What would you guys choose and what are the pros and cons of them? Are there any real alternatives?
I think Flask-Security is deprecated right now. I never used Flask-User on a project. Flask-Login was always my choice for handling sessions/users. You can make your own session handler. I recommend using JWT for authentication & authorization.
I'd roll with Flask-Login (I've used it on many projects with great success and I would use it today on a new project).
It's pretty low level and really only controls the gory bits of ensuring a session is created and potentially persisted with cookies. Then on top of that it gives you access to the idea of having a current_user which is the logged in user and some decorators to ensure a user is logged in.
With Flask-Login you have free reign on how to design the flow and UI of your user registration / authentication system because all it does is handle authentication. Flask-Login also makes it really easy to pick a way that users would get authentication too (such as looking up a user in your database).
If you're worried about commit dates and projects dying, Flask-Login is your best because it's so focused on 1 thing. If you ever wanted to replace that, you could step in and drop in a replacement without having to change much of your code at all.