insynchq / flask-googlelogin Goto Github PK

After authenticating against google, I'm getting "Bad Request: The browser (or proxy) sent a request that this server could not understand." messages.

I'm using the default material in the docs with my IDs, Secret, and Redirect for what I have from Google. I'm hosting on Heroku if that matters.

googlelogin = GoogleLogin(app)
@app.route('/oauth2callback')
@googlelogin.oauth2callback
def create_or_update_user(token, userinfo, **params):
user = User.filter_by(google_id=userinfo['id']).first()
if user:
user.name = userinfo['name']
user.avatar = userinfo['picture']
else:
user = User(google_id=userinfo['id'],
name=userinfo['name'],
avatar=userinfo['picture'])
db.session.add(user)
db.session.flush()
login_user(user)
return redirect(url_for('estimator'))

This doesn't appear to be documented, but I found this from a Stackoverflow answer; postmessage needs to be the redirect_uri, and NOT the URI configured in the Google Developer Console if you're using the new Google+ sign-in button javascript.

Tested it myself and it worked, so it would be great if exchange_code used this optionally based on a config flag or something.

I've been using the extension for some time now. But now I've created a new example based on the one here, and I get the following error:
Warning:
flask_googlelogin/local/lib/python2.7/site-packages/requests/packages/urllib3/util/ssl_.py:90: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. For more information, see https://urllib3.readthedocs.org/en/latest/security.html#insecureplatformwarning

Error:
Traceback (most recent call last):
File "/home/amin/flask_googlelogin/lib/python2.7/site-packages/flask/app.py", line 1836, in call
return self.wsgi_app(environ, start_response)
File "/home/amin/flask_googlelogin/lib/python2.7/site-packages/flask/app.py", line 1820, in wsgi_app
response = self.make_response(self.handle_exception(e))
File "/home/amin/flask_googlelogin/lib/python2.7/site-packages/flask/app.py", line 1403, in handle_exception
reraise(exc_type, exc_value, tb)
File "/home/amin/flask_googlelogin/lib/python2.7/site-packages/flask/app.py", line 1817, in wsgi_app
response = self.full_dispatch_request()
File "/home/amin/flask_googlelogin/lib/python2.7/site-packages/flask/app.py", line 1477, in full_dispatch_request
rv = self.handle_user_exception(e)
File "/home/amin/flask_googlelogin/lib/python2.7/site-packages/flask/app.py", line 1381, in handle_user_exception
reraise(exc_type, exc_value, tb)
File "/home/amin/flask_googlelogin/lib/python2.7/site-packages/flask/app.py", line 1475, in full_dispatch_request
rv = self.dispatch_request()
File "/home/amin/flask_googlelogin/lib/python2.7/site-packages/flask/app.py", line 1461, in dispatch_request
return self.view_functionsrule.endpoint
File "/home/amin/flask_googlelogin/lib/python2.7/site-packages/flask_googlelogin.py", line 198, in decorated
_scheme=self.redirect_scheme,
File "/home/amin/flask_googlelogin/lib/python2.7/site-packages/flask_googlelogin.py", line 144, in exchange_code
if not token or token.get('error'):
AttributeError: 'function' object has no attribute 'get'

Some may want to specify diff scopes in diff parts of their apps.

Any plans to update this library? I can't even install it, and I think it's a dependency compatability issue (requests and compat2?)

  Using cached https://files.pythonhosted.org/packages/fa/d1/0dd60e1146e79e7b193e7b0189d8c13ef100d55cbfe65e1825ac5f03c397/requests-0.14.2.tar.gz
    Complete output from command python setup.py egg_info:
    Traceback (most recent call last):
      File "<string>", line 1, in <module>
      File "/tmp/pip-install-n9u2f5pi/requests/setup.py", line 6, in <module>
        import requests
      File "/tmp/pip-install-n9u2f5pi/requests/requests/__init__.py", line 52, in <module>
        from . import utils
      File "/tmp/pip-install-n9u2f5pi/requests/requests/utils.py", line 22, in <module>
        from .compat import parse_http_list as _parse_list_header
      File "/tmp/pip-install-n9u2f5pi/requests/requests/compat.py", line 112, in <module>
        from .packages import chardet2 as chardet
    ImportError: cannot import name 'chardet2'
    
    ----------------------------------------
Command "python setup.py egg_info" failed with error code 1 in /tmp/pip-install-n9u2f5pi/requests/

Just an fyi, the addition of the credentials keywork arg breaks the application if you have it configured as your doc suggest. I would suggest updating them to demonstrate accepting that parameter or taking `**kwargs`` if you're going to add more.

@app.route('/oauth2callback')
@googlelogin.oauth2callback
def create_or_update_user(userinfo, **kwargs):
    ...

I think it is necessary to pass the login_manager to init_app in __init__ otherwise a new login_manager instance will be created in init_app. Which causes @login_required to return 401 instead of redirecting to Google. (Since context processor is assigned to the wrong login_manager instance.)

def __init__(self, app=None, login_manager=None):
    if login_manager:
        self.login_manager = login_manager
    else:
        self.login_manager = LoginManager()

    if app:
        self._app = app
        self.init_app(app, login_manager=self.login_manager)  # <=  pass current login_manager instance

I stumbled onto this as I tried following snippet from the documentation:

from flask_login import LoginManager
login_manager = LoginManager()
login_manager.init_app(app)
googlelogin = GoogleLogin(app, login_manager)

This could be a misconfiguration on my part, I find the google cloud console pretty confusing but I've been having trouble with the callback returning 400s. I commented out the _scheme=self.redirect_scheme kwarg from the oauth2callback and now it's working perfectly.

This issue is a little cumbersome to reproduce, but I was able to consistently reproduce it.

I had the @login_required wrapper around a view. Having never accepted the permissions for a site, I would try to go that view (call it 'profile' => http://localhost:5000/profile), and get redirected to google with the whole 'do you accept the permissions for this site', etc.

Clicking accept sent me back to oauth2callback, which logged me in and then tried to send me to the page I was trying to go to ('profile'). For some reason though, when I got sent to 'profile', I could see in the logs I then got redirected to google again, which sent me back to oauth2callback, which sent me back to google, etc => which eventually resulted in the browser saying 'cant show page'.

I spent quite a bit of time trying to figure out what was going on, and the only thing I could think was that login_user(user) wasn't actually logging the user in or something. I tested this with the example, and I could reproduce it.

Cannot handle special character.

For example:
SECRET_KEY = '\x91\x85K\xcek\xcc\xb9\x99[$)\xd9\xbc(\x96,\xb4\xcc\xdcGRC\xefz'

UnicodeDecodeError: 'ascii' codec can't decode byte 0x91 in position 0: ordinal not in range(128)
flask_login.py", line 542, in make_secure_token
key = key.encode('utf-8') # ensure bytes

The version of flask_googlelogin installed from the python package index is marked 0.3.1, but it has install_requires= 'requests<1.0', and installs code with the old requests syntax (json as object rather than function call). Super confusing to debug as this is the same as the current version number.