Flask-Login未调用load_user，is_authenticated始终为false问题求助

我正在开发Flask-React Web应用，使用Flask-Login做身份认证，遇到以下问题：

• 登录请求返回{'message': 'Login successful'}，但后续请求/profile时认证失败
• load_user函数未被调用，身份无法跨请求持久化

补充：该功能在Postman中可正常运行，求原因及解决办法。

相关代码 #

models.py

from app import db, ma, login_manager

@login_manager.user_loader
def load_user(user_id):
    r = Users.query.get(int(user_id))
    print(r)
    return r

app.py

from flask_migrate import Migrate
from flask_cors import CORS
from flask import Flask
from flask_sqlalchemy import SQLAlchemy
from flask_marshmallow import Marshmallow
from flask_login import LoginManager, UserMixin, login_user, login_required, logout_user, current_user
from werkzeug.security import check_password_hash

db = SQLAlchemy()
migrate = Migrate()
ma = Marshmallow()
cors = CORS()
login_manager = LoginManager()

def create_app():
    app = Flask(__name__)
    app.config['SECRET_KEY'] = '312312321312'
    app.config["SQLALCHEMY_DATABASE_URI"] = "sqlite:///database.db"
    app.config['SQLALCHEMY_TRACK_MODIFICATIONS'] = False

    db.init_app(app)
    migrate.init_app(app, db)
    ma.init_app(app)
    cors.init_app(app)

    login_manager.init_app(app)
    login_manager.login_view = 'login'
    login_manager.login_message_category = 'info'

    return app

routes.py

import json
from flask import jsonify, request
from app import create_app, db
from models import Orders, Orders_items, Products, Users, Suppliers
from dotenv import load_dotenv
load_dotenv()
from flask_login import login_user, current_user, logout_user, login_required
from passlib.hash import sha256_crypt

app = create_app()

@app.route('/login',methods=['POST','GET'])
def login():
    if current_user.is_authenticated:
        return jsonify({"message": "User is already authenticated"})

    if request.method == 'POST':
        data = request.get_json()
        if 'email' in data and 'password' in data:
            email = data['email']
            password_candidate = data['password']

            user = Users.query.filter_by(email=email).first()
            if user:
                if sha256_crypt.verify(password_candidate, user.password):
                    login_user(user)
                    return jsonify({"message": "Login successful"})
                else:
                    return jsonify({"error": "Invalid Password"}), 401
            else:
                return jsonify({"error": "Invalid Email"}), 401
        else:
            return jsonify({"error": "Missing email or password"}), 400

    return jsonify({"message": "GET request is not supported for this endpoint"}), 405

@app.route('/logout', methods=['POST'])
@login_required
def logout():
    if request.method == 'POST':
        logout_user()
        return jsonify({"message": "Logout successful"})
    else:
        return jsonify({"error": "Method not allowed"}), 405

@app.route('/profile', methods=['GET'])
@login_required
def profile():
    if current_user.is_authenticated:
        user_details = {
            "user_id": current_user.id,
            "username": current_user.username,
            "email": current_user.email
        }
        return jsonify(user_details)
    else:
        return jsonify({"error": "User is not authenticated"}), 401

if __name__ == "__main__":
    app.run(debug=True)

原因及解决方案 #

核心原因

Postman会自动保存并在后续请求中携带Session Cookie，但React等前端框架默认不会在跨域请求中传递Cookie，而Flask-Login完全依赖Session Cookie来识别已登录用户，导致身份无法持久化。

具体修复步骤

1. 配置CORS允许携带凭证
   修改app.py中的CORS初始化，添加supports_credentials=True，允许跨域请求携带Cookie：

cors.init_app(app, supports_credentials=True)

2. 前端请求开启凭证携带
   在React的请求中明确设置携带凭证：

• 使用axios：

axios.get('/profile', { withCredentials: true })

• 使用fetch：

fetch('/profile', { credentials: 'include' })

3. 调整Session Cookie配置（按需）
   根据部署环境调整Cookie属性，确保跨域场景下Cookie能正常传递：

# 开发环境（同域名或子域名）
app.config['SESSION_COOKIE_SAMESITE'] = 'Lax'
app.config['SESSION_COOKIE_SECURE'] = False

# 生产环境（跨不同域名，需HTTPS）
app.config['SESSION_COOKIE_SAMESITE'] = 'None'
app.config['SESSION_COOKIE_SECURE'] = True

4. 确认load_user装饰器生效
   确保models在create_app()之后导入（如routes.py中的顺序），避免循环导入导致@login_manager.user_loader未正确绑定到login_manager实例。

内容的提问来源于stack exchange，提问作者tarek sawara