title: Session on Flask server with Python requests package not working
body: <p>I've written Flask server with flask_login. To login user, I use <code>login_user(user)</code>, and I have one page of my site protected with <code>@login_required</code>. As a client, I use Python requests package, that's the code:</p>
  
  <pre><code>import requests
  sess = requests.session()
  sess.post("http://page.on/my/site", data={"login" : "login", "password" : "password"})
  </code></pre>
  
  <p>Everything is OK with this authentication, but then I try to access the secured page:</p>
  
  <pre><code>r = sess.get("http://secure.page/on/the/site")
  </code></pre>
  
  <p>And this requests receives <code>Unauthorized</code>. 
  That's cookies set after authentication (for now I have my server on localhost):</p>
  
  <pre><code>&lt;RequestsCookieJar[&lt;Cookie session=.eJwdzjkSwjAMAMC_uE4h2dbhfCZjHR5oE1Ix_B2Gbst9l2OdeT3K_jrv3MrxjLKX5tqBGbq7MfmPiYi8aA7RAG8haZJoDZ0HrlSG6Oa1-yCqsaJNJlSVAQToNXsAt8UiFQBIbIa3bmYiarYyiEaNsUJjmlLZyn3l-c_Uzxf_2C6a.Cnf0yA.xIUSIFgcvjqwszrbwCA_D2Rqa5k for localhost.local/&gt;]&gt;
  </code></pre>
  
  <p>BTW, I also use this:</p>
  
  <pre><code>login_manager.session_protection = "strong"
  </code></pre>
  
  <p>How to fix this authentication problems?</p>
  
  <p>UPD:</p>
  
  <p>That's server login code:</p>
  
  <pre><code>@api.route("/login/", methods=["POST"])
  def handle_login_request():
      login, password = str(request.form['login']).lower(), str(request.form['password'])
      # Get and check user here
      login_user(user)
      # update user and get user_data
      return jsonify(user_data)
  </code></pre>
  
  <p>Secured route:</p>
  
  <pre><code>@api.route("/users_of_group/")
  @login_required
  def get_user_of_users_group():
      # code here never executes because of @login_required
  </code></pre>
  
  <p><code>api</code> is the name of flask Blueprint</p>
  
  <p>UPD2:</p>
  
  <p>That's content of page returned by <code>sess.get</code>:</p>
  
  <pre><code> &lt;!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN"&gt;
   &lt;title&gt;401 Unauthorized&lt;/title&gt;
   &lt;h1&gt;Unauthorized&lt;/h1&gt;
   &lt;p&gt;The server could not verify that you are authorized to access the URL requested.  You either supplied the wrong credentials (e.g. a bad password), or your browser doesn't understand how to supply the credentials required.&lt;/p&gt;
  </code></pre>
  
  <p>UPD3:
  I tried to use this:</p>
  
  <pre><code>r = sess.get("http://secure.page/on/the/site", auth=("login", "password"))
  </code></pre>
  
  <p>On the server I can see, that at first user is successfully logged in, but then the server throws 401 anyway.</p>
  
  <pre><code>import requests
  sess = requests.session()
  login = sess.post("http://page.on/my/site", data={"login" : "login", "password" : "password"})
  r = sess.get("http://secure.page/on/the/site", cookies=login.cookies)
  </code></pre>
  
  <p>Also logins user and then throws 401.</p>
  
  <p>UPD4:</p>
  
  <p>Problem appears to be in login_user function, it doesn't change <code>is_authenticated</code> to <code>True</code>. I use SQLAlchemy and this is my user class:</p>
  
  <pre><code>class User(db.Model):
      user_id = db.Column(db.Integer, primary_key=True)
      # Many required for my app fields
      is_active = db.Column(db.Boolean, default=False)
      is_authenticated = db.Column(db.Boolean, default=False)
      is_anonymous = db.Column(db.Boolean, default=False)
      is_online = db.Column(db.Boolean, default=False)
  
      # Init function 
  
      def get_id(self):
          return str(self.user_id)
  </code></pre>
  
  <p>And <code>user_loader</code>:</p>
  
  <pre><code>@login_manager.user_loader
  def load_user(user_id):
      print(user_id, type(user_id))
      user = User.query.filter_by(user_id=int(user_id)).first()
      print(user.login, user.is_authenticated)
      return user
  </code></pre>
  
  <p>Id is printed correctly, its type is <code>str</code>, query works just fine, but I still get <code>Unauthenticated</code> error, and in the last <code>print</code> <code>user.is_authenticated</code> is False.</p>
  
  <p>UPD5:</p>
  
  <p>Actually, printing <code>user.is_authenticated</code> just after <code>login_user</code> also shows False, even though I called <code>session.commit()</code> after <code>login_user</code>.</p>