mkhorasani / Streamlit-Authenticator

A secure authentication module to validate user credentials in a Streamlit application.
Apache License 2.0
1.38k stars 229 forks source link

Failure with cookie authentication patch required as workaround #54

Open philippelt opened 1 year ago

philippelt commented 1 year ago

I am using streamlit-Authenticator which works almost fine except that cookie faster reauthentication never worked.

I am using streamline 1.20.0 and streamlit-authenticator 0.2.1 with python 3.10.6

I've done some analysis and found that the problem is in the module streamlit_authenticator/authenticate.pyat line #106.

The function call :

self.token = self.cookie_manager.get(self.cookie_name)

do NOT return the token value but return None (I checked that the browser effectively sent the cookie properly).

I replaced this line by:

allCookies = self.cookie_manager.get_all()
self.token = allCookies.get(self.cookie_name, None)

and then the correct token value is recovered and processed as expected allowing me to recover authentication.

Any idea why the get do not work ?

mkhorasani commented 1 year ago

Hi @philippelt, thank you for checking this. What version of the cookies library are you using? Are you using extra_streamlit_components==0.1.55? This issue should not occur, and I can't really figure out why it is happening.

philippelt commented 1 year ago

I am using streamline 1.20.0 and streamlit-authenticator 0.2.1 with python 3.10.6

The extra_streamlit_component automatically installed is 0.1.56

This behavior was consistent between Safari, Firefox and Chrome.

The Streamlit app is running on Ubuntu 22.04

philippelt commented 1 year ago

The difference between the two methods is that get(...) is working on a local dictionary copy (self.cookies) of the cookies set at init of the CookieManagerclass wether get_all(...) is requesting the actual cookies from js cookie_manager.

Looks like the context of the class instance may be lost somewhere... But I am not familiar with streamlit components thus I don't understand the effect of the key parameter used to call js cookie_manager which is init in the initialization of the class and get_all for the get_all method. This is rather part of extra_streamlit_component.