Reputation: 95
I have four environments: production
, qa
, dev
, and my local
development environment. The local
development environment is the only environment experiencing this issue. The three working apps are served via apache2
while my local
environment uses the flask development web server.
The issue I am encountering is well described here. I am fairly confident the reason is lorenmh's first bullet point.
Are your sessions set up correctly? If a user navigates away from your site and back, do they have the same session?
Following lepture 's response in a very similar post as well as diving into the authlib function to set the state variable in the flask session.
print(flask.request.args.get('state'), flask.session.keys())
I was able to show that the session is being cleared as print statement shows the request from he server has the state variable generated by authlib meanwhile the session has been completely cleared.
state_variable123 dict.keys([])
I have tried setting some flask configuration variables.
config.py
SESSION_REFRESH_EACH_REQUEST = False
SESSION_COOKIE_SAMESITE = "Lax"
unfortunately I am still encountering the error authlib.integrations.base_client.errors.MismatchingStateError: mismatching_state: CSRF Warning! State not equal in request and response
Again, as mentioned by lorenm https://github.com/lepture/authlib/issues/376 I don't think this is an issue with the authlib library. How can I stop the session from renewing between OAuth2.0 requests? Strange that I have 3 environments that do not have this issue. The only difference I can think of right now is how they are served.
Upvotes: 0
Views: 121