Flask-security: token_loader method of Flask-Login's LoginManager object has been removed

[PierreRochard]

The token_loader method of Flask-Login's LoginManager object has been removed, predictably causing a AttributeError: 'LoginManager' object has no attribute 'token_loader' error.

The method is used here: https://github.com/mattupstate/flask-security/blob/9e5865d9735b0b292360f63588ed4725c376757e/flask_security/core.py#L226

The method was removed by @alanhamlett in this commit: https://github.com/maxcountryman/flask-login/commit/f4ff19c33356999e96e3c5b4e80bc7788c85d7a3#diff-ef9a1bd470a8fcf8c774e8f67e4ccc40L205

I'm not sure how to fix this issue so I wanted to share it. I searched the relevant keywords and did not find an existing issue. Please let me know if you have any questions.

Thank you, I've enjoyed using this package.

[alanhamlett]

Token loader was removed because user's can easily create an insecure token if they didn't correctly use the utils.make_secure_token inside their custom token loader. The same functionality can be achieved with a request_loader so the insecure token_loader wasn't really needed.

The solution for Flask-Security is to replace token_loader with request_loader. I can do a PR if that helps?

[jirikuncar]

@alanhamlett great, I just wanted to do that. Let's hope we can get it to upstream soon.

[alanhamlett]

558 fixes this. I'll try to submit a PR here before we merge breaking changes to Flask-Login in the future.

[jirikuncar]

FYI @mattupstate tweeted that he is looking for maintainers.

[jonafato]

Thanks for the report and the quick fix. I can review the PR later today.

[jonafato]

@PierreRochard @alanhamlett I'm going to do my best to summarize what happened here (with some backstory).

1. Flask-Login's latest release included a breaking change.
2. The last time this happened, Flask-Security issued a fix and pinned the Flask-Login requirement.
3. I'm guessing that Flask-Login got upgraded independently of Flask-Security in @PierreRochard's situation, and Python's packaging tools don't prevent this from happening after the initial installation step (a larger issue that can't be addressed by these packages).

Current status:

• #558 fixes the issue, and I'll get that merged in shortly.
• For now, anyone newly installing Flask-Security shouldn't experience this issue because of the version restrictions in place.
• Going forward, I'd love to see (and help with) more collaboration between the Flask-Login and Flask-Security projects to make sure we can mitigate these headaches for the libraries' end users as much as possible. To start, I've subscribed to Flask-Login notifications to make sure I see breaking changes before they land in new releases.