Python Flask POST / GET请求

Question

I need help with user authentication in my website. 我的网站需要用户身份验证方面的帮助。 I am using python flask, sqlite3 and DB Browser for SQLite. 我正在使用python flask，sqlite3和DB Browser for SQLite。 I'm having trouble with the login part. 我在登录部分遇到问题。 Each time I try to login and redirect to an html website it says error 404. 每次我尝试登录并重定向到html网站时都会显示错误404。

Here is the code for the login page: 以下是登录页面的代码：

<!DOCTYPE html>
<html>
  <head>
    <meta charset = "UTF-8"/>
    <title>PackageDrop Login</title>
    <link type = "text/css" rel = "stylesheet" href="{{ url_for('static', filename='login.css') }}" />
    <link type = "text/css" rel = "stylesheet" href="{{ url_for('static', filename='cssmainpage.css') }}" />
  </head>
  <body>
    <form action="/login" method="POST" autocomplete="off">
    Username:<br>
    <input type="text" name="username">
    <br>
    Password:<br>
    <input type="password" name="password">
    <br><br>
    <input type="submit" value="Login">
    </body>
</html>

The page that is forwarded to is just simple html, nothing special so I am not uploading it. 转发到的页面只是简单的html，没什么特别的，所以我没有上传它。 If you feel like you need more information to understand, ask and I will post quickly. 如果您觉得需要了解更多信息，请询问，我会尽快发布。 Thanks for all the help I get. 感谢我得到的所有帮助。

EDIT1: Changed in the login.html the form action from "login.html" to "login" and now it gives a 400 Bad Request error. EDIT1：在login.html中将表单操作从“login.html”更改为“login”，现在它给出了400 Bad Request错误。

EDIT2: The redirection works. EDIT2：重定向有效。 I have changed the code for the login but it makes this error: "ProgrammingError: SQLite objects created in a thread can only be used in that same thread. The object was created in thread id 7812 and this is thread id 7388". 我已经更改了登录的代码但它出现了这个错误：“ProgrammingError：在线程中创建的SQLite对象只能在同一个线程中使用。该对象是在线程ID 7812中创建的，这是线程ID 7388”。 The only thing that I did is just connect to the database like this: conn = sqlite3.connect('database.db') This is the new code for the login: 我做的唯一事情就是连接到数据库，如下所示：conn = sqlite3.connect（'database.db'）这是登录的新代码：

@app.route('/login', methods=['GET', 'POST'])
def login():
    error = None
    checkP = conn.execute('select pword from users where uname = request.form[\'username\']')
    arrayCheck = checkP.fetchall()
    if request.method == 'POST':
        if request.form['password'] != arrayCheck[[0][0]]:
            error = 'Incorrect password'
            return redirect(url_for('login.html'))
        elif len(arrayCheck) == 0:
            error = 'Username or password is incorrect'
            return redirect(url_for('login.html'))
        else:
            session['logged_in'] = True
            flash('You are logged in')
            return redirect(url_for("userpage"))
    return render_template('login.html')

Answer 1

Http 404 code means page not found . Http 404代码表示page not found 。 When you post your form your redirects is to userpage.html but your form action is to /login route. 当您发布表单时，您的重定向是userpage.html但您的表单操作是/login route。 Your action should be the target page to redirect after post successfully action="/userpage" I assume you have userpage view function. 您的操作应该是在发布成功action="/userpage"后重定向的目标页面action="/userpage"我假设您具有userpage视图功能。 Or you can leave action blank just try with redirect function redirect(url_for('userpage')) . 或者您可以将操作留空，只需尝试使用重定向功能redirect(url_for('userpage')) 。 Note url_for() function takes view function name not template name. 注意url_for()函数采用视图函数名称而不是模板名称。 One last thing I didn't pay attention on your login logic. 最后一件事我没注意你的登录逻辑。

Answer 2

username = request.form['uname']
password = request.form['pword']
if request.form['uname'] != username:
    error = 'Incorrect username'
if request.form['pword'] != password:
    error = 'Incorrect password'

As Daniel Roseman explained this logic is flawed. 丹尼尔罗斯曼解释说这种逻辑是有缺陷的。 What you need to do is compare password provided by the user with the password you have stored in your database. 什么，你需要做的是比较password与已存储在数据库中的密码的用户提供。

In pseudo code, it would look something like this: 在伪代码中，它看起来像这样：

username = request.form['uname']
password = request.form['pword']
try:
    db_password = my_db.get('uname')
    if password == db_password:
        session['logged_in'] = True
    else: 
        error = "Password provided does not match Database"
except Exception as exc:
    error = "Could not obtain password from Database : {}".format(exc)

This is just minimum, of course you could improve on this. 这只是最小的，当然你可以改进这一点。

Python Flask POST / GET请求

问题描述

2 个解决方案

解决方案1
1 2017-01-08 13:56:50

解决方案2
1 2017-01-10 02:42:17

Python Flask POST / GET请求

问题描述

2 个解决方案

解决方案1 1 2017-01-08 13:56:50

解决方案2 1 2017-01-10 02:42:17

解决方案1
1 2017-01-08 13:56:50

解决方案2
1 2017-01-10 02:42:17