Unexpected Logout

[Sepehrworklife]

Hello! I implemented AuthenticateBackEnd as the documentation said.
The problem is when I walk around pages suddenly page will redirect to login.
I checked the responses, at first it will return 302 Found and then redirected to the login page with a 200 status code.
My authenticate function is just like a document:
return "token" in request. session
It should be mentioned that everything is okay in the first minutes then the problem occurs. There is no specific time too.

If it helps:

• Proxy server is Apache
• SSL enabled. (works fine)
• Didn't add session middleware manually myself

I would be grateful if you could help me.

[aminalaee]

Hey,
I doubt it has anything to do with time, the SessionMiddleware used by default should be valid for two weeks.

Can you post the flow example of the request?
You are trying to access something like /admin/users and you are redirected to login page?
I think the 302 is when token" in request. session is False, so you are redirected to the login, but it's not clear why it's happening.

[Sepehrworklife]

Thank you so much for your kind replies.
I tried it without the Apache Reverse Proxy ( IP: PORT without SSL ) also the same behavior happened.
I taught somehow it is related to the SQLAlchemy warnings, although after fixing them nothing changed.

[aminalaee]

Thank you so much for your kind replies.

No worries :)

Can you also post how you are using the AdminAuthenticate in Admin?
You don't generate random secret key by any chance?

[Sepehrworklife]

Actually, I am:))

auth_backend = AdminAuthenticate(secret_key=secrets.token_hex(32))

Is it wrong?
I read about it in an article that this way is better than generating statically.

[aminalaee]

Ah that's the issue.
Each time your app is restarted, or I think when a worker is killed and restarted automatically in Gunicorn, it will generate a random secret here and previous sessions will be invalid.
I think this will cause a lot of issues, depending on how you deploy your app.

[Sepehrworklife]

Ahh, I see.
I was struggling with this issue for several weeks.
Thank you so much for your helps 🙏

[Sepehrworklife]

With @aminalaee helps I recognized that this issue occurred because the session secret key generated every time a gunicorn worker killed or restarted.
When I used a static secret key the problem has been solved.

Thanks to @aminalaee