Flask session variables

Question

I'm writing a small web app with flask. I have a problem with session variables when two users (under the same network) try to use app.

This is the code:

import os

from flask import Flask, request, render_template, g, session
from random import randint

def random():
     session['number'] = randint(0,4)
     return None

@app.route('/')
def home():
  if not session.get('logged_in'):
    return render_template('login.html')
  else: 
    return check()

@app.route('/login', methods = ['GET', 'POST'])
def login():
      global username
      username = request.form['username']
      session['logged_in'] = True
      session['username'] = username
      return check()

@app.route('/check', methods=['GET', 'POST'])
def check():
       random()
       return render_template('file.html', number = session['number'], user = session['username'])

if __name__ == "__main__":
    app.secret_key = ".."
    app.run(host = '0.0.0.0',port = 3134, debug=False)

In file.html there is a button type "submit" that call '/check' route. The problem is when two users use app at same time because the variable 'number' is equal to variable 'number' of the last user that push the button... there isn't indipendence between two sessions.

I would that the two users has two indipendence sessions, like if they use my app in local host.

Answer 1

Using randint(0,4) to generate number means that they will sometimes be equal for different users. To generate unique number every time use uuid:

from uuid import uuid4
def random():
    session['number'] = str(uuid4())
    return None

or generator:

import itertools
consequent_integers = itertools.count()

def random():
    session['number'] = consequent_integers.next()
    return None

Answer 2

The reason that the session variable is the same for the two users is likely because you're using the same computer / browsing account. It's just like how Facebook remembers your login status after you open a new Facebook tab.

I advise you to get another computer or use a different Chrome Account (top right of Google Chrome) to test out for different users.

Answer 3

So you do something like this. It is not tested but should work. You retrieve the current username and the numbers dictionary from the session variable. Check if there is an existing value for the current username. If not create a random number and save it in the session. Else just use the saved value.

@app.route('/check', methods=['GET', 'POST'])
def check():

   # retrieve current username and numbers from your session
   username = session['username']
   numbers = session.get('numbers', {})

   # if no number is existing create a new one and save it to session
   if username not in numbers:
       number = randint(0,4)
       numbers['username'] = number
       session['numbers'] = numbers
   else:
       number = numbers['username']

   return render_template('file.html', number=number, user=username)