generate_token() provide two different tokens

[bimhud]

I have multiple apps running behind DispatcherMiddleware, each app will have it's all instance of flask_htpassword. All apps sharing the same password file.

when accessing any endpoints for a particular app, authentication using token sometimes denied, sometimes allowed. I looked into the issue and found that generate_token() provide different token string when it called and there are two distinct tokens consistently generated. When using one of the tokens for authentication, it sometimes failed because the system accept the other token.

Not sure what the issue is?

[carsongee]

I'm not sure what is happening here. I'm just taking a sha256 of the user's htpasswd file's hash to obscure, so unless the user is changing, or the htpasswd file is changing between requests, it should stay fixed. Is it possible the htpasswd file is changing, and there isn't a full restart of the flask app server between changes? It does remain fixed in memory at the start time, so I could see a gunicorn type process having different configurations amongst it's forked processes if the file is changing.

[bimhud]

Thank you for the quick response.
I found the issue. As I generated the .htpasswd file on the fly based on the current set of users, multiple processes were competing to overwrite the file, hence the file was changing while the processes holding old info in the memory. This makes the old info become invalid.

I had a early assumption the the password file won't change, but they do for each time generating.

I have updated the logic to make sure the file is protected and it's working great.

If there is a param to indicate if the password file could be reload for every single request, this will provide certain flexibility for adding more user at the run-time. What do you think?

[carsongee]

That sounds like a good feature, and it might even be more what people expect as the default. I'm going to reopen this to track the request.