Unable to log in with Flask-WTF and Flask-Login

I'm building a Flask application with user login functionality using Flask-WTF for form handling and Flask-Login for user authentication. However, I am unable to log in successfully. The page does not redirect as expected, and the login validation does not work.

I have implemented CSRF protection, and I believe the issue might be with how the data is being validated or how the routes are configured.

Result:

1. No error appears, but the login fails.
2. Sometimes I get Invalid credentials even though the credentials are correct.

Expected Behavior:

When a user enters valid credentials, they should be logged in and redirected to the homepage.

What I've Tried:

1. Ensured that I am redirecting using url_for() to a valid route.
2. Added csrf.init_app(app) in my create_app() function.
3. Included {{ form.csrf_token() }} in my login form.
4. Verified that my database connection works, and user data is stored correctly.
5. Checked that Flask-Login's login_user() function is being called.

Why does the login fail, and how do I ensure that the redirection works as expected after successful logins?

Environment:

• Flask 2.x
• Flask-WTF
• Flask-SQLAlchemy
• MySQL
• Python 3.12

Code Snippets:

__init__.py

from flask import Flask
from flask_sqlalchemy import SQLAlchemy
from flask_migrate import Migrate
from flask_bcrypt import Bcrypt
from flask_login import LoginManager
from flask_wtf.csrf import CSRFProtect

db = SQLAlchemy()
migrate = Migrate()
bcrypt = Bcrypt()
login_manager = LoginManager()
csrf = CSRFProtect()

def create_app():
    app = Flask(__name__)
    app.config['SQLALCHEMY_DATABASE_URI'] = 'mysql://root:Root1234!@localhost/school_hub'
    app.config['SQLALCHEMY_TRACK_MODIFICATIONS'] = False
    app.secret_key = 'your-secret-key'

    db.init_app(app)
    migrate.init_app(app, db)
    login_manager.init_app(app)
    bcrypt.init_app(app)
    csrf.init_app(app)

    login_manager.login_view = 'login'

    from .routes import main as main_blueprint
    app.register_blueprint(main_blueprint)

    with app.app_context():
        db.create_all()

    return app

@login_manager.user_loader
def load_user(user_id):
    from .models import User
    return User.query.get(int(user_id))

routes.py

from flask import render_template, request, redirect, url_for, flash
from flask_login import login_user
from .models import User
from .forms import LoginForm

@app.route("/login", methods=["GET", "POST"])
def login():
    form = LoginForm()
    if form.validate_on_submit():
        email = form.email.data
        password = form.password.data
        user = User.query.filter_by(email=email).first()

        if user and user.check_password(password):
            login_user(user)
            return redirect(url_for('home'))
        else:
            flash("Invalid credentials", "danger")
    return render_template("login.html", form=form)

login.html

<form action="" method="POST">
    {{ form.csrf_token() }}
    {{ form.email.label() }}
    {{ form.email() }}
    <br>
    {{ form.password.label() }}
    {{ form.password() }}
    <br>
    {{ form.submit() }}
</form>

forms.py

from flask_wtf import FlaskForm
from wtforms import StringField, PasswordField, SubmitField
from wtforms.validators import DataRequired, Email

class LoginForm(FlaskForm):
    email = StringField('Email', validators=[DataRequired(), Email()])
    password = PasswordField('Password', validators=[DataRequired()])
    submit = SubmitField('Login')

models.py

from . import db, bcrypt
from flask_login import UserMixin

class User(db.Model, UserMixin):
    id = db.Column(db.Integer, primary_key=True)
    email = db.Column(db.String(150), unique=True, nullable=False)
    password = db.Column(db.String(150), nullable=False)

    def check_password(self, password):
        return bcrypt.check_password_hash(self.password, password)

posted about 1 month ago

CC BY-SA 4.0

23d ago by Andreas witnessed the end of the world today‭

misbahskuy‭

11 reputation 1 0 2 0