'flask-security-too with peewee + mysql not working

After beating my head against the wall for a bit, I've decided I need help from the gurus here on stackoverflow. It's very possible I'm missing something incredibly obvious.

I'm attempting to work with Flask-Security-Too since Flask-Security appears idle.

I used the code in the peewee database quick start (https://flask-security-too.readthedocs.io/en/stable/quickstart.html#basic-peewee-application) and everything worked as expected. I swapped the peewee.SqliteDatabase for peewee.MySQLDatabase and I can no longer login.

To verify the MySQL connection was actually working, I added this simple code block after the connection initialized.

db = FlaskDB(app)

query = User.select()
for user in query:
   print(user.email)

When I start the flask server, the application prints out the user's email addresses in both the SQLite and MySQL configuration. So it makes me think the issues isn't with the MySQL connection params.

One interesting tidbit, I turned on the MySQL general_log to 100% verify that the application was in fact querying the database. When I've already logged in via the SQLite config, then switch the connection over to MySQL but still have the session cookie, it will query the MySQL database looking for the user in the session cookie (query below). When I delete the session cookie and attempt to login, I see connections to the MySQL database but no queries.

Here is the MySQL query when I have a session cookie after logging in via SQLite.

SELECT `t1`.`id`, `t1`.`email`, `t1`.`password`, `t1`.`active`, `t1`.`fs_uniquifier`, `t1`.`confirmed_at` FROM `user` AS `t1` WHERE (`t1`.`fs_uniquifier` = '908d836c5d7845eaaa0a8637e7c4229b') LIMIT 1 OFFSET 0

Here is the connection entry for MySQL with no queries. It just connects and quits.

Connect   [email protected] on training using TCP/IP
Query     SET sql_mode='PIPES_AS_CONCAT'
Query     SET AUTOCOMMIT = 0
Quit

Flask-Security-Too will throw an error message on the MySQL login attempt that "Specified user does not exist" (which I think is an OWASP issue but that's a different concern). Since it didn't query the database, it makes sense that it wouldn't find the user. But why isn't it querying the database?!?

I checked the peewee database object between SQLlite and MySQL and see no differences. Getting excited that I might be able to contribute to an opensource project, I started browsing the code in Flask-Security-Too but I don't see an obvious issue there either. I'm stumped. Hoping someone else has hit this issue and could give me some guidance.

Thanks in advance.



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source