AKA_Tom
AKA_Tom

Reputation: 95

Flask starting new session in OAuth2.0 flow via Authlib causing CSRF warning and 500 status code

I have four environments: production, qa, dev, and my local development environment. The local development environment is the only environment experiencing this issue. The three working apps are served via apache2 while my local environment uses the flask development web server.

The issue I am encountering is well described here. I am fairly confident the reason is lorenmh's first bullet point.

Are your sessions set up correctly? If a user navigates away from your site and back, do they have the same session?

Following lepture 's response in a very similar post as well as diving into the authlib function to set the state variable in the flask session.

print(flask.request.args.get('state'), flask.session.keys())

I was able to show that the session is being cleared as print statement shows the request from he server has the state variable generated by authlib meanwhile the session has been completely cleared.

state_variable123 dict.keys([])

I have tried setting some flask configuration variables.

config.py

SESSION_REFRESH_EACH_REQUEST = False
SESSION_COOKIE_SAMESITE = "Lax"

unfortunately I am still encountering the error authlib.integrations.base_client.errors.MismatchingStateError: mismatching_state: CSRF Warning! State not equal in request and response

Again, as mentioned by lorenm https://github.com/lepture/authlib/issues/376 I don't think this is an issue with the authlib library. How can I stop the session from renewing between OAuth2.0 requests? Strange that I have 3 environments that do not have this issue. The only difference I can think of right now is how they are served.

Upvotes: 0

Views: 121

Answers (0)

Related Questions