Flask-Security重复登录提示‘invalid password’问题求助

Hey there, I totally get how frustrating it is when your registration and first login work perfectly, but then you hit an "invalid password" error the next time you try to log in. Let's walk through the most likely causes and how to check them:

1. Verify Password Hash Persistence & Integrity #

First, let's rule out issues with how the password hash is stored in your SQLite database:

• Check the database directly: Use a tool like the sqlite3 command line or DB Browser for SQLite to look at your user table. Compare the password hash right after registration vs. after your first successful login. If the hash changed between those two steps, something in your code is overwriting the hash during login.
• Manual hash validation: Run a quick test in your Python environment to confirm the hash from the database matches your password:

  from passlib.context import CryptContext
  # Use the same hash scheme you have configured in Flask-Security (default is bcrypt)
  pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
  # Replace these with your actual password and the hash from the database
  print(pwd_context.verify("your_registration_password", "hash_from_sqlite_db"))
  

  If this returns True right after registration but False after login, your code is modifying the hash somewhere.

2. Check User Loader & Session Logic #

Flask-Security relies on Flask-Login's user_loader callback to fetch users during login. Make sure this isn't causing issues:

• Confirm your user_loader is correct: It should only fetch the user from the database without modifying any fields (especially the password hash). Example of a correct loader:

  @login_manager.user_loader
  def load_user(user_id):
      return User.query.get(int(user_id))
  

• Look for custom login hooks: If you added any @security.login_handler or post-login functions, check if they're accidentally updating the user's password field (even indirectly) and committing that change to the database.

3. Validate Database Transactions #

SQLite uses transactions by default, so incomplete commits can cause unexpected behavior:

• Ensure registration commits the session: After creating a new user, you must call db.session.commit() to persist the data to disk. If you only do db.session.add(user) without committing, the first login might use the in-memory user object, but subsequent logins will pull from the (unupdated) database file.
• Check for auto-commit issues: Some setups might have auto-commit disabled, so make sure all database writes (including user creation) are properly committed.

4. Review Flask-Security Configuration #

Incorrect or changing configuration is a common culprit:

• Check SECURITY_PASSWORD_HASH and SECURITY_PASSWORD_SALT: These values must stay consistent across application restarts. If you're generating the salt dynamically (e.g., in __init__.py without a fixed value) or changing the hash scheme between runs, the password verification will fail.
  Example of correct static configuration:

  app.config['SECURITY_PASSWORD_HASH'] = 'bcrypt'
  app.config['SECURITY_PASSWORD_SALT'] = 'your_fixed_salt_string_here'
  

• Avoid runtime configuration changes: Make sure these settings aren't being modified anywhere in your code after the app starts.

5. Check Dependency & Environment Compatibility #

Your Python 3.6.4 environment might have version conflicts:

• List your dependencies: Run pip freeze to check versions of Flask-Security, passlib, Flask-SQLAlchemy, etc. Older versions of these packages might have bugs with password handling in Python 3.6. For example, some early passlib versions had issues with bcrypt in older Python releases.
• Test with a clean environment: Try creating a fresh virtualenv, installing only the necessary dependencies (Flask, Flask-Security, Flask-SQLAlchemy, flask-bootstrap, passlib), and see if the issue persists. This can rule out conflicting packages.

Start with checking the password hash in the database first—it's usually the quickest way to narrow down the problem. Let me know if any of these steps lead you to the root cause!

内容的提问来源于stack exchange，提问作者Francisco