Why i am getting 400 error if i used flask_session in my application?

Question

Recently i started to use flask_session extension in my application, also i am using flask_wtf.csrf extension token for security purposes.

Now , before flask_session the application worked perfectly , but when i installed flask_session and configured it parameters in my config.py, if i tried to login or to register the application gives me 400 Bad Request The CSRF session token is missing., in fact, i am including the csrf_token in all my requests including also ajax requests .

The session storing type is sqlalchemy:

SESSION_COOKIE_NAME = 'booking'
SESSION_TYPE = 'sqlalchemy'
PERMANENT_SESSION_LIFETIME = timedelta(seconds=120)
SESSION_SQLALCHEMY_TABLE = 'sessions'
SESSION_KEY_PREFIX = 'booking'

I forgot to mention, i noticed if i changed the type to 'filesystem' the error not showing up .

Here is the flask_session documentation for more information.

Login template:

<form class="login_form" role="form" action="{{url_for('client.login')}}" method="post">
    {{ login_form.hidden_tag() }}

    {% if login_form.telephone.errors %}
        {% for e in login_form.telephone.errors %}
            <p class="text-error">{{e}}</p>
        {% endfor %}
    {% endif %}
    {{login_form.telephone(class="_bit mat_input", id="form-phone-number", placeholder="You login")}}

    {% if login_form.password.errors %}
        {% for e in login_form.password.errors %}
            <p class="text-error">{{e}}</p>
        {% endfor %}
    {% endif %}
    {{login_form.password(class="_bit mat_input",  id="form-password", placeholder="Your password")}}

    <a href="" class="login_button">
        <button type="submit" class="mat_button _bib">Login</button>
    </a>

    <div class="_dis_b rfb">
        <div class="remember_row">
            <label for="remember" class="remember">remember me</label>
            {{login_form.remember_me(id="remember", class="check")}}
        </div>
        <div class="forgot_row">
            <a href="javascript:void(0);" class="forgot">Forgot password?</a>
        </div>
    </div>
</form>

Client views.py :

@client_route.route('/client/cat-<dir_code>/login', methods=['GET','POST'])
def login():
    form_login = ClientLogin()
    if request.method == 'GET' and request.args.get('next'):
        session['next'] = request.args.get('next')

    if form_login.validate_on_submit():
        user = Client.query.filter_by(
            tele = form_login.telephone.data
        ).first()

        if user:
            if check_password_hash(user.password, form_login.password.data):
                session['client_logged_in'] = user.name
                session['client_family'] = user.family
                session['client_image'] = user.image
                session['client_phone'] = user.tele
                if 'next' in session:
                    next = session.get('next')
                    session.pop('next')
                    return redirect(next+'?current_user='+session.get('client_logged_in')+'+'+session.get('client_family'))
                else:
                    return redirect(url_for('client.lenta', dir_code=g.current_directory)+'?current_user='+session.get('client_logged_in')+'+'+session.get('client_family'))
            else:
                flash('Invalid credentials.', 'danger')
                return redirect(url_for('client.login', dir_code=g.current_directory))
        else:
            flash('Invalid credentials.', 'danger')
            return redirect(url_for('client.login', dir_code=g.current_directory))
    return render_template('client/login.html', user=user, form_login=form_login)

Answer 1

I suggest you don't set SESSION_COOKIE_DOMAIN at all and then go on from there and try alternatives. Check whether you have set the configuration setting SESSION_COOKIE_SECURE. If you're working in localhost or through an unsecure line and you have set SESSION_COOKIE_SECURE=True then no session cookie will be sent and as such no forms, csrf protection and various other operations will work. Instead use SESSION_COOKIE_SECURE=False under these circumstances.

Answer 2

This is an old post, but for anyone with the same problem add below line to your settings.cfg file, It worked for me :

SESSION_COOKIE_DOMAIN = "your_server_address"