From ccp at drsb.com.my  Sun Aug  5 08:31:32 2018
From: ccp at drsb.com.my (CCP Dragonedge)
Date: Sun, 5 Aug 2018 20:31:32 +0800
Subject: [Flask] Deploying as a Windows service
Message-ID: <CAK_UXh3hgSJvTFqM2mVLW95XqKWNtSTSmzZ+dXxk67iCa2V5Gw@mail.gmail.com>

Hi,

I am deploying my Flask application on Apache24 using mod_wsgi 4.5.4
running on a Windows 7 machine. I have encountered something strange - when
I start and stop Apache manually (i.e. by typing httpd.exe from the command
line to start, and just hitting ctrl-C to stop), everything works fine.

When I, however, install Apache as a Windows service (by doing a "httpd -k
install"; so it starts up when the machine is booted), I get a "500
internal server error" when I try to access my Flask application.

According to the error logs, Flask can't see my modules. I know it's
something to do with Apache because when I just run the Flask server
("python myapp.py"), I have no problems.

Anyone experience this? If so, how did you overcome this? And I hope this
isn't off-topic - if it is, sorry and please point me to the right place.

Thanks,
p
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/flask/attachments/20180805/ef8b12a4/attachment.html>

From unai at sysbible.org  Sun Aug  5 14:10:51 2018
From: unai at sysbible.org (Unai Rodriguez)
Date: Sun, 5 Aug 2018 20:10:51 +0200
Subject: [Flask] Deploying as a Windows service
In-Reply-To: <CAK_UXh3hgSJvTFqM2mVLW95XqKWNtSTSmzZ+dXxk67iCa2V5Gw@mail.gmail.com>
References: <CAK_UXh3hgSJvTFqM2mVLW95XqKWNtSTSmzZ+dXxk67iCa2V5Gw@mail.gmail.com>
Message-ID: <d8771f57-c846-4d9d-b447-aa056067ebe0@Spark>

Hi,

(1) Is there any more specific error on Apache error logs?

(2) I?d make sure first Apache starts properly as a service. Can you test something else (perhaps a simple html page) ?to make the Apache service is configured properly?

(3) If getting (1) and (2) did not help enough for you to figure it out, please submit exact steps on how yo configured Apache to start as a service and the Apache configuration for your Flask app

Thanks,
Unai Rodriguez
On 5 Aug 2018, 14:31 +0200, CCP Dragonedge <ccp at drsb.com.my>, wrote:
> Hi,
>
> I am deploying my Flask application on Apache24 using mod_wsgi 4.5.4 running on a Windows 7 machine. I have encountered something strange - when I start and stop Apache manually (i.e. by typing httpd.exe from the command line to start, and just hitting ctrl-C to stop), everything works fine.
>
> When I, however, install Apache as a Windows service (by doing a "httpd -k install"; so it starts up when the machine is booted), I get a "500 internal server error" when I try to access my Flask application.
>
> According to the error logs, Flask can't see my modules. I know it's something to do with Apache because when I just run the Flask server ("python myapp.py"), I have no problems.
>
> Anyone experience this? If so, how did you overcome this? And I hope this isn't off-topic - if it is, sorry and please point me to the right place.
>
> Thanks,
> p
> _______________________________________________
> Flask mailing list
> Flask at python.org
> https://mail.python.org/mailman/listinfo/flask
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/flask/attachments/20180805/433a8192/attachment.html>

From ccp at drsb.com.my  Sun Aug  5 22:27:37 2018
From: ccp at drsb.com.my (CCP Dragonedge)
Date: Mon, 6 Aug 2018 10:27:37 +0800
Subject: [Flask] Deploying as a Windows service
In-Reply-To: <d8771f57-c846-4d9d-b447-aa056067ebe0@Spark>
References: <CAK_UXh3hgSJvTFqM2mVLW95XqKWNtSTSmzZ+dXxk67iCa2V5Gw@mail.gmail.com>
 <d8771f57-c846-4d9d-b447-aa056067ebe0@Spark>
Message-ID: <CAK_UXh0Ap6oktj1yoMAhaPETN=8wb=2C+ofFrjDhEdvNFopDCw@mail.gmail.com>

Hi Unai,

Thanks for taking the time.

With regards to (1), I didn't see anything more meaningful. Inside my
myapp.py, I do a "from module wfADM import wfUser". It just says it
couldn't find module wfADM.

As for (2), before I installed mod_wsgi, I did test it out as a Windows
service on a simple html file - no problems.

This is the entire scenario (sorry in advance for this long post):

Initially, I had Python 2.7, Flask, and MySQL 8 running on a Windows 7 box.
This wasn't my development machine, it was going to be production, but I
just wanted to make sure that everything worked, as I had never worked with
Apache before. Then, I installed Apache 2.4 - pleasantly surprised that it
was really easy. No problem as a Windows service, either (i.e. httpd -k
install, then going into Services and starting it up).

So, apart from Apache, my production and development machines were
basically identical. Therefore, I tried to install mod_wsgi on my
DEVELOPMENT machine - and ran into all sorts of pain. After a very helpful
exchange with the mod_wsgi boss, Graham Dumpleton, on Github (#347), my
conclusion was that I had to use Python 3.6. After doing that (the only
real change I had to make was changing MySQLdb to pymsql), I then managed
to install mod_wsgi 4.5.4 (after much effort - I finally realized I had to
install the latest Visual C++ compilers from Microsoft). Then, everything
worked fine (now that I think of it, I didn't try to set up Apache as a
Windows service on my development machine - I'll give that a shot when I
have a bit more time).

Regardless, I basically did this on my PRODUCTION environment based on my
experience on my development box:

0) Apache24 and MySQL 8 already installed, so I just left them
1) Uninstalled Python 2.7, which also gets rid of Flask
2) Installed Python 3.6
3) Installed Flask
   - tested my application on the Flask server; worked without any problems
4) Installed mod_wsgi
   - had to install the Visual C++ compilers, but after that, no issues
5) Set up the virtual host and the wsgi file, which leads to....

Current situation:
When I manually start up Apache by just typing httpd.exe on the command
line, no problems accessing my Flask app from Apache. But when I try to set
up Apache as a Windows service (httpd -k install, and then going to
Services), I get the problem above (unable to see my modules).

Thanks for taking the time to read this!
p

On 6 August 2018 at 02:10, Unai Rodriguez <unai at sysbible.org> wrote:

> Hi,
>
> (1) Is there any more specific error on Apache error logs?
>
> (2) I?d make sure first Apache starts properly as a service. Can you test
> something else (perhaps a simple html page)  to make the Apache service is
> configured properly?
>
> (3) If getting (1) and (2) did not help enough for you to figure it out,
> please submit exact steps on how yo configured Apache to start as a service
> and the Apache configuration for your Flask app
>
> Thanks,
> Unai Rodriguez
> On 5 Aug 2018, 14:31 +0200, CCP Dragonedge <ccp at drsb.com.my>, wrote:
>
> Hi,
>
> I am deploying my Flask application on Apache24 using mod_wsgi 4.5.4
> running on a Windows 7 machine. I have encountered something strange - when
> I start and stop Apache manually (i.e. by typing httpd.exe from the command
> line to start, and just hitting ctrl-C to stop), everything works fine.
>
> When I, however, install Apache as a Windows service (by doing a "httpd -k
> install"; so it starts up when the machine is booted), I get a "500
> internal server error" when I try to access my Flask application.
>
> According to the error logs, Flask can't see my modules. I know it's
> something to do with Apache because when I just run the Flask server
> ("python myapp.py"), I have no problems.
>
> Anyone experience this? If so, how did you overcome this? And I hope this
> isn't off-topic - if it is, sorry and please point me to the right place.
>
> Thanks,
> p
> _______________________________________________
> Flask mailing list
> Flask at python.org
> https://mail.python.org/mailman/listinfo/flask
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/flask/attachments/20180806/58a8696f/attachment.html>

From ccp at drsb.com.my  Sun Aug  5 22:31:40 2018
From: ccp at drsb.com.my (CCP Dragonedge)
Date: Mon, 6 Aug 2018 10:31:40 +0800
Subject: [Flask] Deploying as a Windows service
In-Reply-To: <CAK_UXh0Ap6oktj1yoMAhaPETN=8wb=2C+ofFrjDhEdvNFopDCw@mail.gmail.com>
References: <CAK_UXh3hgSJvTFqM2mVLW95XqKWNtSTSmzZ+dXxk67iCa2V5Gw@mail.gmail.com>
 <d8771f57-c846-4d9d-b447-aa056067ebe0@Spark>
 <CAK_UXh0Ap6oktj1yoMAhaPETN=8wb=2C+ofFrjDhEdvNFopDCw@mail.gmail.com>
Message-ID: <CAK_UXh25cLzm4cAEOP2aCcsN1egUE+1WTXJ3Mn1yXCn2byR1bA@mail.gmail.com>

Sorry, it should be mod_wsgi 4.6.4, not 4.5.4
p

On 6 August 2018 at 10:27, CCP Dragonedge <ccp at drsb.com.my> wrote:

> Hi Unai,
>
> Thanks for taking the time.
>
> With regards to (1), I didn't see anything more meaningful. Inside my
> myapp.py, I do a "from module wfADM import wfUser". It just says it
> couldn't find module wfADM.
>
> As for (2), before I installed mod_wsgi, I did test it out as a Windows
> service on a simple html file - no problems.
>
> This is the entire scenario (sorry in advance for this long post):
>
> Initially, I had Python 2.7, Flask, and MySQL 8 running on a Windows 7
> box. This wasn't my development machine, it was going to be production, but
> I just wanted to make sure that everything worked, as I had never worked
> with Apache before. Then, I installed Apache 2.4 - pleasantly surprised
> that it was really easy. No problem as a Windows service, either (i.e.
> httpd -k install, then going into Services and starting it up).
>
> So, apart from Apache, my production and development machines were
> basically identical. Therefore, I tried to install mod_wsgi on my
> DEVELOPMENT machine - and ran into all sorts of pain. After a very helpful
> exchange with the mod_wsgi boss, Graham Dumpleton, on Github (#347), my
> conclusion was that I had to use Python 3.6. After doing that (the only
> real change I had to make was changing MySQLdb to pymsql), I then managed
> to install mod_wsgi 4.5.4 (after much effort - I finally realized I had to
> install the latest Visual C++ compilers from Microsoft). Then, everything
> worked fine (now that I think of it, I didn't try to set up Apache as a
> Windows service on my development machine - I'll give that a shot when I
> have a bit more time).
>
> Regardless, I basically did this on my PRODUCTION environment based on my
> experience on my development box:
>
> 0) Apache24 and MySQL 8 already installed, so I just left them
> 1) Uninstalled Python 2.7, which also gets rid of Flask
> 2) Installed Python 3.6
> 3) Installed Flask
>    - tested my application on the Flask server; worked without any problems
> 4) Installed mod_wsgi
>    - had to install the Visual C++ compilers, but after that, no issues
> 5) Set up the virtual host and the wsgi file, which leads to....
>
> Current situation:
> When I manually start up Apache by just typing httpd.exe on the command
> line, no problems accessing my Flask app from Apache. But when I try to set
> up Apache as a Windows service (httpd -k install, and then going to
> Services), I get the problem above (unable to see my modules).
>
> Thanks for taking the time to read this!
> p
>
> On 6 August 2018 at 02:10, Unai Rodriguez <unai at sysbible.org> wrote:
>
>> Hi,
>>
>> (1) Is there any more specific error on Apache error logs?
>>
>> (2) I?d make sure first Apache starts properly as a service. Can you test
>> something else (perhaps a simple html page)  to make the Apache service is
>> configured properly?
>>
>> (3) If getting (1) and (2) did not help enough for you to figure it out,
>> please submit exact steps on how yo configured Apache to start as a service
>> and the Apache configuration for your Flask app
>>
>> Thanks,
>> Unai Rodriguez
>> On 5 Aug 2018, 14:31 +0200, CCP Dragonedge <ccp at drsb.com.my>, wrote:
>>
>> Hi,
>>
>> I am deploying my Flask application on Apache24 using mod_wsgi 4.5.4
>> running on a Windows 7 machine. I have encountered something strange - when
>> I start and stop Apache manually (i.e. by typing httpd.exe from the command
>> line to start, and just hitting ctrl-C to stop), everything works fine.
>>
>> When I, however, install Apache as a Windows service (by doing a "httpd
>> -k install"; so it starts up when the machine is booted), I get a "500
>> internal server error" when I try to access my Flask application.
>>
>> According to the error logs, Flask can't see my modules. I know it's
>> something to do with Apache because when I just run the Flask server
>> ("python myapp.py"), I have no problems.
>>
>> Anyone experience this? If so, how did you overcome this? And I hope this
>> isn't off-topic - if it is, sorry and please point me to the right place.
>>
>> Thanks,
>> p
>> _______________________________________________
>> Flask mailing list
>> Flask at python.org
>> https://mail.python.org/mailman/listinfo/flask
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/flask/attachments/20180806/fe3065de/attachment-0001.html>

From coreybrett at gmail.com  Sun Aug  5 23:05:14 2018
From: coreybrett at gmail.com (Corey Boyle)
Date: Sun, 5 Aug 2018 23:05:14 -0400
Subject: [Flask] Deploying as a Windows service
In-Reply-To: <CAK_UXh25cLzm4cAEOP2aCcsN1egUE+1WTXJ3Mn1yXCn2byR1bA@mail.gmail.com>
References: <CAK_UXh3hgSJvTFqM2mVLW95XqKWNtSTSmzZ+dXxk67iCa2V5Gw@mail.gmail.com>
 <d8771f57-c846-4d9d-b447-aa056067ebe0@Spark>
 <CAK_UXh0Ap6oktj1yoMAhaPETN=8wb=2C+ofFrjDhEdvNFopDCw@mail.gmail.com>
 <CAK_UXh25cLzm4cAEOP2aCcsN1egUE+1WTXJ3Mn1yXCn2byR1bA@mail.gmail.com>
Message-ID: <CAD=ssw0VxW+WX_0PXZS4Eg5awXfz4J7QZx0U8yR-MB9_7hrccA@mail.gmail.com>

is Apache using a different config file when running as a service?

could also be a file system permission issue?

what account is the service running under?


__
Corey

On Sun, Aug 5, 2018, 10:31 PM CCP Dragonedge <ccp at drsb.com.my> wrote:

> Sorry, it should be mod_wsgi 4.6.4, not 4.5.4
> p
>
> On 6 August 2018 at 10:27, CCP Dragonedge <ccp at drsb.com.my> wrote:
>
>> Hi Unai,
>>
>> Thanks for taking the time.
>>
>> With regards to (1), I didn't see anything more meaningful. Inside my
>> myapp.py, I do a "from module wfADM import wfUser". It just says it
>> couldn't find module wfADM.
>>
>> As for (2), before I installed mod_wsgi, I did test it out as a Windows
>> service on a simple html file - no problems.
>>
>> This is the entire scenario (sorry in advance for this long post):
>>
>> Initially, I had Python 2.7, Flask, and MySQL 8 running on a Windows 7
>> box. This wasn't my development machine, it was going to be production, but
>> I just wanted to make sure that everything worked, as I had never worked
>> with Apache before. Then, I installed Apache 2.4 - pleasantly surprised
>> that it was really easy. No problem as a Windows service, either (i.e.
>> httpd -k install, then going into Services and starting it up).
>>
>> So, apart from Apache, my production and development machines were
>> basically identical. Therefore, I tried to install mod_wsgi on my
>> DEVELOPMENT machine - and ran into all sorts of pain. After a very helpful
>> exchange with the mod_wsgi boss, Graham Dumpleton, on Github (#347), my
>> conclusion was that I had to use Python 3.6. After doing that (the only
>> real change I had to make was changing MySQLdb to pymsql), I then managed
>> to install mod_wsgi 4.5.4 (after much effort - I finally realized I had to
>> install the latest Visual C++ compilers from Microsoft). Then, everything
>> worked fine (now that I think of it, I didn't try to set up Apache as a
>> Windows service on my development machine - I'll give that a shot when I
>> have a bit more time).
>>
>> Regardless, I basically did this on my PRODUCTION environment based on my
>> experience on my development box:
>>
>> 0) Apache24 and MySQL 8 already installed, so I just left them
>> 1) Uninstalled Python 2.7, which also gets rid of Flask
>> 2) Installed Python 3.6
>> 3) Installed Flask
>>    - tested my application on the Flask server; worked without any
>> problems
>> 4) Installed mod_wsgi
>>    - had to install the Visual C++ compilers, but after that, no issues
>> 5) Set up the virtual host and the wsgi file, which leads to....
>>
>> Current situation:
>> When I manually start up Apache by just typing httpd.exe on the command
>> line, no problems accessing my Flask app from Apache. But when I try to set
>> up Apache as a Windows service (httpd -k install, and then going to
>> Services), I get the problem above (unable to see my modules).
>>
>> Thanks for taking the time to read this!
>> p
>>
>> On 6 August 2018 at 02:10, Unai Rodriguez <unai at sysbible.org> wrote:
>>
>>> Hi,
>>>
>>> (1) Is there any more specific error on Apache error logs?
>>>
>>> (2) I?d make sure first Apache starts properly as a service. Can you
>>> test something else (perhaps a simple html page)  to make the Apache
>>> service is configured properly?
>>>
>>> (3) If getting (1) and (2) did not help enough for you to figure it out,
>>> please submit exact steps on how yo configured Apache to start as a service
>>> and the Apache configuration for your Flask app
>>>
>>> Thanks,
>>> Unai Rodriguez
>>> On 5 Aug 2018, 14:31 +0200, CCP Dragonedge <ccp at drsb.com.my>, wrote:
>>>
>>> Hi,
>>>
>>> I am deploying my Flask application on Apache24 using mod_wsgi 4.5.4
>>> running on a Windows 7 machine. I have encountered something strange - when
>>> I start and stop Apache manually (i.e. by typing httpd.exe from the command
>>> line to start, and just hitting ctrl-C to stop), everything works fine.
>>>
>>> When I, however, install Apache as a Windows service (by doing a "httpd
>>> -k install"; so it starts up when the machine is booted), I get a "500
>>> internal server error" when I try to access my Flask application.
>>>
>>> According to the error logs, Flask can't see my modules. I know it's
>>> something to do with Apache because when I just run the Flask server
>>> ("python myapp.py"), I have no problems.
>>>
>>> Anyone experience this? If so, how did you overcome this? And I hope
>>> this isn't off-topic - if it is, sorry and please point me to the right
>>> place.
>>>
>>> Thanks,
>>> p
>>> _______________________________________________
>>> Flask mailing list
>>> Flask at python.org
>>> https://mail.python.org/mailman/listinfo/flask
>>>
>>>
>>
>
> _______________________________________________
> Flask mailing list
> Flask at python.org
> https://mail.python.org/mailman/listinfo/flask
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/flask/attachments/20180805/eb908206/attachment.html>

From ccp at drsb.com.my  Mon Aug  6 07:15:07 2018
From: ccp at drsb.com.my (CCP Dragonedge)
Date: Mon, 6 Aug 2018 19:15:07 +0800
Subject: [Flask] Deploying as a Windows service
In-Reply-To: <CAD=ssw0VxW+WX_0PXZS4Eg5awXfz4J7QZx0U8yR-MB9_7hrccA@mail.gmail.com>
References: <CAK_UXh3hgSJvTFqM2mVLW95XqKWNtSTSmzZ+dXxk67iCa2V5Gw@mail.gmail.com>
 <d8771f57-c846-4d9d-b447-aa056067ebe0@Spark>
 <CAK_UXh0Ap6oktj1yoMAhaPETN=8wb=2C+ofFrjDhEdvNFopDCw@mail.gmail.com>
 <CAK_UXh25cLzm4cAEOP2aCcsN1egUE+1WTXJ3Mn1yXCn2byR1bA@mail.gmail.com>
 <CAD=ssw0VxW+WX_0PXZS4Eg5awXfz4J7QZx0U8yR-MB9_7hrccA@mail.gmail.com>
Message-ID: <CAK_UXh3jz0ArErWWk_iLijketv50WcpTG-repnz_OHjdJDBvng@mail.gmail.com>

Hi Corey,

Good suggestions. This time I tried to set it as a Windows service on my
development machine - same problem. I get the ModuleNotFoundError. Looking
at the Task Manager, it says that Apache is running me, which shouldn't be
a problem, as I am an administrator.

Regardless, I managed to find a workaround. I just added httpd.exe to my
Startup folder...seems to work.

Thanks,
p

On 6 August 2018 at 11:05, Corey Boyle <coreybrett at gmail.com> wrote:

> is Apache using a different config file when running as a service?
>
> could also be a file system permission issue?
>
> what account is the service running under?
>
>
> __
> Corey
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/flask/attachments/20180806/01c4bb78/attachment.html>

From ccp at drsb.com.my  Tue Aug 14 21:54:41 2018
From: ccp at drsb.com.my (CCP Dragonedge)
Date: Wed, 15 Aug 2018 09:54:41 +0800
Subject: [Flask] Flask sessions management and Flask-Login
Message-ID: <CAK_UXh25Tr0Rbs=g+Jvkh5yutSSoOSWLa_kWkZiv2ZEFS=CyXw@mail.gmail.com>

Hi,

I've been going over the documentation about sessions management and
Flask-Login, and just want to make sure my understanding is correct.

Let's say I have my login and logout code as such (this is pseudo-code):

def login:

   if USER_IS_VALID():
      session['userID'] = str(FROM_DATABASE(username, password))

def logout:
   session.pop('userID')

This is sufficient to make sure that after a user logs out, someone can't
go and just click on the browser's Back button and steal that user's
session - provided that every page always makes sure that userID is in the
session - right?

But I assume the above approach is NOT sufficient to handle concurrent
users. Is that correct?

So, to handle concurrent users (i.e. keeping their session data apart), one
should use Flask-Login?

Finally, Flask-Login documentation doesn't say it specifically, but all the
examples that I've seen online assume the use of Flask-SQLAlchemy. Has
anyone used Flask-Login without using Flask-SQLAlchemy? I ask because the
database portion of the legacy code that I'm working on has Python routines
to access and manipulate the data (kind of like my pseudo-code; security
reasons). But I can't actually get at SQL statements (i.e. I don't know
exactly the table structure).

If anyone could confirm my suspicions, I would appreciate it greatly.

Thanks,
p
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/flask/attachments/20180815/95bfa50e/attachment.html>

From davidnieder at gmx.de  Wed Aug 15 09:04:38 2018
From: davidnieder at gmx.de (David Nieder)
Date: Wed, 15 Aug 2018 15:04:38 +0200
Subject: [Flask] Flask sessions management and Flask-Login
In-Reply-To: <CAK_UXh25Tr0Rbs=g+Jvkh5yutSSoOSWLa_kWkZiv2ZEFS=CyXw@mail.gmail.com>
References: <CAK_UXh25Tr0Rbs=g+Jvkh5yutSSoOSWLa_kWkZiv2ZEFS=CyXw@mail.gmail.com>
Message-ID: <b4b72941-116a-52d3-9f10-b8a127f0fe81@gmx.de>

Hi
It has been a while since I used flask but I will try to answer your 
questions.

Flask uses cookie based sessions. Everything you write to the 'session' 
dict gets transmitted to the client alongside the rest of your http 
response. On the next request the client (the browser) sends everything 
back to the server and Flask makes the data available to your app via 
the session object.
Make sure to set 'SECRET_KEY' in your application so the framework can 
cryptographically sign your data, but I think Flask will warn you about 
that.

Now, to your questions.

On 8/15/18 3:54 AM, CCP Dragonedge wrote:
> Hi,
> 
> I've been going over the documentation about sessions management and
> Flask-Login, and just want to make sure my understanding is correct.
> 
> Let's say I have my login and logout code as such (this is pseudo-code):
> 
> def login:
> 
>     if USER_IS_VALID():
>        session['userID'] = str(FROM_DATABASE(username, password))
> 
> def logout:
>     session.pop('userID')
> 
> This is sufficient to make sure that after a user logs out, someone can't
> go and just click on the browser's Back button and steal that user's
> session - provided that every page always makes sure that userID is in the
> session - right?

Yes, as long as an attacker doesn't manage to steal the cookie, you 
should be fine.

> > But I assume the above approach is NOT sufficient to handle concurrent
> users. Is that correct?

No, every user has its own session.

> 
> So, to handle concurrent users (i.e. keeping their session data apart), one
> should use Flask-Login?

Flask-Login helps you with common tasks such as logging an user in and 
out and restricting some of your views to logged-in users.
You do not need to work with the session object directly anymore.

> 
> Finally, Flask-Login documentation doesn't say it specifically, but all the
> examples that I've seen online assume the use of Flask-SQLAlchemy. Has
> anyone used Flask-Login without using Flask-SQLAlchemy? I ask because the
> database portion of the legacy code that I'm working on has Python routines
> to access and manipulate the data (kind of like my pseudo-code; security
> reasons). But I can't actually get at SQL statements (i.e. I don't know
> exactly the table structure).

No, what kind of ORM or database you use is entirely up to you. You just 
need a way to tell if the credentials a user provides when logging-in 
are correct and some unique ID to tell your users apart.

> 
> If anyone could confirm my suspicions, I would appreciate it greatly.
> 
> Thanks,
> p
> 

I hope this clarified things a bit for you.

Happy coding,
David

From ccp at drsb.com.my  Wed Aug 15 23:03:23 2018
From: ccp at drsb.com.my (CCP Dragonedge)
Date: Thu, 16 Aug 2018 11:03:23 +0800
Subject: [Flask] Flask Digest, Vol 38, Issue 4
In-Reply-To: <mailman.46.1534348803.12258.flask@python.org>
References: <mailman.46.1534348803.12258.flask@python.org>
Message-ID: <CAK_UXh3sWtmbvz5HrUfivRvJSm+RokvKrgDMAGaj_W7t17gx8w@mail.gmail.com>

Hi David,

Thanks for the answers! Very clear and concise - much appreciated.
p


Message: 2
> Date: Wed, 15 Aug 2018 15:04:38 +0200
> From: David Nieder <davidnieder at gmx.de>
> To: flask at python.org
> Subject: Re: [Flask] Flask sessions management and Flask-Login
> Message-ID: <b4b72941-116a-52d3-9f10-b8a127f0fe81 at gmx.de>
> Content-Type: text/plain; charset=utf-8; format=flowed
>
> Hi
> It has been a while since I used flask but I will try to answer your
> questions.
>
> Flask uses cookie based sessions. Everything you write to the 'session'
> dict gets transmitted to the client alongside the rest of your http
> response. On the next request the client (the browser) sends everything
> back to the server and Flask makes the data available to your app via
> the session object.
> Make sure to set 'SECRET_KEY' in your application so the framework can
> cryptographically sign your data, but I think Flask will warn you about
> that.
>
> Now, to your questions.
>
> On 8/15/18 3:54 AM, CCP Dragonedge wrote:
> > Hi,
> >
> > I've been going over the documentation about sessions management and
> > Flask-Login, and just want to make sure my understanding is correct.
> >
> > Let's say I have my login and logout code as such (this is pseudo-code):
> >
> > def login:
> >
> >     if USER_IS_VALID():
> >        session['userID'] = str(FROM_DATABASE(username, password))
> >
> > def logout:
> >     session.pop('userID')
> >
> > This is sufficient to make sure that after a user logs out, someone can't
> > go and just click on the browser's Back button and steal that user's
> > session - provided that every page always makes sure that userID is in
> the
> > session - right?
>
> Yes, as long as an attacker doesn't manage to steal the cookie, you
> should be fine.
>
> > > But I assume the above approach is NOT sufficient to handle concurrent
> > users. Is that correct?
>
> No, every user has its own session.
>
> >
> > So, to handle concurrent users (i.e. keeping their session data apart),
> one
> > should use Flask-Login?
>
> Flask-Login helps you with common tasks such as logging an user in and
> out and restricting some of your views to logged-in users.
> You do not need to work with the session object directly anymore.
>
> >
> > Finally, Flask-Login documentation doesn't say it specifically, but all
> the
> > examples that I've seen online assume the use of Flask-SQLAlchemy. Has
> > anyone used Flask-Login without using Flask-SQLAlchemy? I ask because the
> > database portion of the legacy code that I'm working on has Python
> routines
> > to access and manipulate the data (kind of like my pseudo-code; security
> > reasons). But I can't actually get at SQL statements (i.e. I don't know
> > exactly the table structure).
>
> No, what kind of ORM or database you use is entirely up to you. You just
> need a way to tell if the credentials a user provides when logging-in
> are correct and some unique ID to tell your users apart.
>
> >
> > If anyone could confirm my suspicions, I would appreciate it greatly.
> >
> > Thanks,
> > p
> >
>
> I hope this clarified things a bit for you.
>
> Happy coding,
> David
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/flask/attachments/20180816/c5801d43/attachment.html>

From travis.a.everett at gmail.com  Thu Aug 16 19:03:30 2018
From: travis.a.everett at gmail.com (Travis Everett)
Date: Thu, 16 Aug 2018 18:03:30 -0500
Subject: [Flask] brittle extension app.config antipatterns?
Message-ID: <CAC=jSUXVB_jMz5iD8WE46-C5RT3Z_hrn+dbNKjpHYV7T8it23w@mail.gmail.com>

Hi all,

Ecosystem topic; not expecting a "solution".

I've been tidying how we structure and configure extensions, often after
someone finds a setting won't work or we need a new command with distinct
settings.

In the process I've found config-sequence fragility created when extensions
take one-time action on class __init__ or app_init. A clear case is saving
an app.config value into the internal extension state at init and never
checking again. A more insidious case is when an extension does access
app.config directly, but conditionally configures itself based on values
present at init time. These may *appear* to respect a change in app.config,
but have undefined behavior.

Not trying to throw anyone under a bus, but I did want to link examples:

   -
   https://github.com/libwilliam/flask-cdn/blob/bab871e3a687fc2a65c9f6aff9058e4d17141fb4/flask_cdn.py#L97
   -
   https://github.com/e-dard/flask-s3/blob/b8c72b40eb38a05135eec36a90f1ee0c96248f72/flask_s3.py#L489
   -
   https://github.com/mattupstate/flask-mail/blob/1709c70d839a7cc7b1f7eeb97333b71cd420fe32/flask_mail.py#L559

I haven't surveyed for this sort of thing, so I'm not sure how common it
is. There may be more antipatterns (extensions that hard-set defaults
without seeing if they're already configured?)

Cheers,
Travis

Apologies if this has already been beaten to death. I didn't see anything
obvious when I searched Github issues, browsed the last year on the current
list, and searched both list archives via Google.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/flask/attachments/20180816/cf0ee6eb/attachment.html>