mkhorasani / Streamlit-Authenticator

A secure authentication module to validate user credentials in a Streamlit application.
Apache License 2.0
1.38k stars 229 forks source link

hope authentication_status not sync across multi pages #92

Closed leo-fengchao closed 7 months ago

leo-fengchao commented 9 months ago

On default, the authentication_status stores in session_state which makes the login status sync across multi pages.

However, in my case, I don't want the authentication_status sync across multi pages.

For now, I added some code to achieve this need. It will check current loggin username is existed in config yaml file of current page. If not, it will set authentication_status to None and logout to True. Manually log the current user out.

if authentication_status and name not in config['credentials']['usernames'].keys():
    st.session_state['logout'] = True
    st.session_state['name'] = None
    st.session_state['username'] = None
    st.session_state['authentication_status'] = None
elif authentication_status == False:
    st.error('Username/password is incorrect')
elif authentication_status == None:
    st.warning('Please enter your username and password')
else:
    authenticator.logout('Logout', 'main')
    st.write(f'Welcome,**{name}**')
    show_main_interface()  

Hope there would be a native support for this.

mkhorasani commented 3 months ago

Dear @leo-fengchao, if you are using Streamlit-Authenticator with multi-page apps, you will have to recreate the authenticator object on each and every page and invoke the login method as shown below:

authenticator = stauth.Authenticate(
    config['credentials'],
    config['cookie']['name'],
    config['cookie']['key'],
    config['cookie']['expiry_days'],
    config['pre-authorized']
)

authenticator.login()

This is to ensure that when a user hard refreshes the page and the session state variables related to re-authentication are lost, the authenticator object is there to re-initialize them from the cookie saved on the browser.