Flask-security: "Unauthorized" When I send my token to server

[tim-hub]

flask + flask security + uwsgi + nginx
On vuejs frontend, they give me this:

<h1>Unauthorized</h1>
<p>The server could not verify that you are authorized to access the URL
requested. You either supplied the wrong credentials (e.g. a bad password),
or your browser doesn't understand how to supply the credentials required.
</p>

I am sure all is good when I run the server locally. The authorization is running well. But not on remote server. Every post/get with token required return me the unauthorized error.

Anyone know the reason? I got know ideas? Should I consider some config of nginx or uwsgi

[briancappello]

@tim-hub
Are you sure your Flask session is working correctly? Check especially if your SECRET_KEY is set and that cookies are configured and working properly (even if you're storing your session server-side instead of the default in-cookies, cookies are still necessary). Culprits include SESSION_COOKIE_PATH, SESSION_COOKIE_SECURE, and SESSION_COOKIE_DOMAIN. Also make sure you're sending the cookies along with your ajax requests, eg by setting credentials: 'include' if you're using fetch.

[bsamadi]

Is there a working example of how to send the token to the Flask server?

[briancappello]

@bsamadi I've been working on a boilerplate that uses Flask-Security token (and session) auth, the code is here: https://github.com/briancappello/flask-react-spa

Files of interest:

• Sending the token to the backend (note the Authentication-Token and X-CSRFToken headers):
  https://github.com/briancappello/flask-react-spa/blob/master/frontend/app/utils/request.js#L27

• Checking the token (note how you must specify you want to accept token auth to Flask-Security's auth_required decorator):
  https://github.com/briancappello/flask-react-spa/blob/master/backend/security/decorators.py#L59

The repo is still under active development, but the authentication system works.

[SaguruHakuba]

I am trying to find any example to send token, after verifying password, from server to the browser, and then how does that send it back for verification?