Question

I have built a website using flask (http://www.csppdb.com). Sometimes when I log in as one user, log out, then login as another user I still see pages from the first user I logged in as. This problem is immediately fixed when the page is refreshed. I think this is called “caching” if I am not mistaken. Is there any way I could disable this on a site wide level so that every page that is visited needs a new refresh?

It would be like sharing your computer with a friend. He logs into Facebook, then logs out. Now you log in on his computer and you see his profile… (awkward). After you refresh the page the problem is fixed.

Here is some of my code. I was using flask-login but I then tried to “roll my own”

from flask.ext.mysql import MySQL
import os
from flask import Flask, request, jsonify, session, url_for, redirect, \
     render_template, g, flash
from data import *
from werkzeug import check_password_hash, generate_password_hash
import config

app = Flask(__name__)
mysql = MySQL()

app.config['MYSQL_DATABASE_HOST'] = os.environ['MYSQL_DATABASE_HOST'] if 'MYSQL_DATABASE_HOST' in os.environ else config.MYSQL_DATABASE_HOST
app.config['MYSQL_DATABASE_PORT'] = os.environ['MYSQL_DATABASE_PORT'] if 'MYSQL_DATABASE_PORT' in os.environ else config.MYSQL_DATABASE_PORT
app.config['MYSQL_DATABASE_USER'] = os.environ['MYSQL_DATABASE_USER'] if 'MYSQL_DATABASE_USER' in os.environ else config.MYSQL_DATABASE_USER
app.config['MYSQL_DATABASE_PASSWORD'] = os.environ['MYSQL_DATABASE_PASSWORD'] if 'MYSQL_DATABASE_PASSWORD' in os.environ else config.MYSQL_DATABASE_PASSWORD
app.config['MYSQL_DATABASE_DB'] = os.environ['MYSQL_DATABASE_DB'] if 'MYSQL_DATABASE_DB' in os.environ else config.MYSQL_DATABASE_DB

mysql.init_app(app)

if 'SECRET_KEY' in os.environ: app.config['SECRET_KEY'] = os.environ['SECRET_KEY']
else: app.config['SECRET_KEY'] = os.urandom(24)

def connect_db(): return mysql.connect()

def check_auth():
    g.user = None
    if 'username' in session:
        g.user = get_user(session['username'])
        return
    return redirect(url_for('login'))

@app.route('/')
def home(): 
    if 'username' in session: return redirect(url_for('main'))
    return render_template('home.html')

def connect_db(): return mysql.connect()

@app.teardown_request
def teardown_request(exception):
    if exception: print exception
    g.db.close()

@app.before_request
def before_request():
    print session.keys(), session.values()
    print("before request")
    print ('username' in session, "in session?")
    g.db = connect_db()
    g.user = None
    if "username" in session:
        g.user = get_user(session['username'])


@app.route('/login/', methods=['GET', 'POST'])
def login():
    """Logs the user in."""
    if 'username' in session:
        return redirect(url_for('main'))

    error = None
    if request.method == 'POST':
        print("login hit")
        user = get_user(request.form['username'])
        if user is None:
            error = 'Invalid username'
            print error
        elif not check_password_hash(user.password, request.form['password']):
            error = 'Invalid password'
            print error
        else:
            flash('You were logged in')
            print "logged in"
            session['username'] = request.form['username']
            g.user = request.form['username']
            print error, "error"
            return redirect(url_for('main'))

    return render_template('login.html', error=error)

Answer 1

Setting the cache to be max-age=0 fixed it.

@app.after_request
def add_header(response):
    """
    Add headers to both force latest IE rendering engine or Chrome Frame,
    and also to cache the rendered page for 10 minutes.
    """
    response.headers['X-UA-Compatible'] = 'IE=Edge,chrome=1'
    response.headers['Cache-Control'] = 'public, max-age=0'
    return response