From what I investigated, the user is not being kept logged in between accesses to the pages.
I am running Yosai==0.3.2
and I'm making use of the web component.
I've noticed that, after the user is logged in, the session is not kept between pages.
According to the web's mgt.py:87-90 code, the user id is gotten from the context while also the web_registry is available on that same line. On that line, even though, the web_registry which is available there with the current session_id, the session_id is got from the context and not from the web_registry.
From me following the code, I find that, at no point in the execution of YosaiWeb the session_id is got from the web_registry. Am I doing something wrong?
I am not allowing users to use the remember_me
functionality by not giving them the option to
I've tried searching through the tests and I can't find any test that actually tests to flask web so a user logs in and then testing if the session was kept on between requests.
As a temp-fix, I will change that line 89 so it gets the session from the web registry when the one from the context is None
@Dowwie How do I unstuck myself without creating security holes?