search

pallets-eco / flask-session

Server side session extension for Flask
https://flask-session.readthedocs.io
BSD 3-Clause "New" or "Revised" License
507 stars 238 forks source link

RedisSessionInterface: Flask context not popped on Redis issues #82

Closed kilianm closed 8 months ago

kilianm commented 7 years ago

Redis exceptions on open_session make Flask crash painfully, not popping the context correctly (leaking data across requests). Flask doesn't catch any possible exceptions on the session_interface, resulting in messing up the context.

To reproduce

  1. Set some parameter in flask.g
  2. Initiate RedisSessionInterface on an invalid redis server (redis.exceptions.ConnectionError or any other, we had sometimes Timeout exceptions).
  3. The next requests contains the old flask.g - context not popped

Fix Ideally Flask uses its interfaces safely - always popping context. Bug created: https://github.com/pallets/flask/issues/2517 Still, I think it would be nice that Flask-Session is safe as well, catching possible redis problems and not letting Flask deal with the exceptions.

Environment Python version: 2.7.6 Flask version: 0.10.1 Werkzeug version: 0.11.11 Flask-Session: 0.3.1

Lxstr commented 8 months ago

The heart of this issue is fixed in flask https://github.com/pallets/flask/pull/2254.

Regarding handling in flask-session, I think it is better to use SESSION_REDIS = Redis(host='localhost', port=6379, retry=retry, retry_on_error=[BusyLoadingError, ConnectionError, TimeoutError])