No need to keep authentication token in DB

example/app.py

@@ -183,7 +183,6 @@ def create_sqlalchemy_app(auth_config=None, register_blueprint=True):
         login_count = db.Column(db.Integer)
         active = db.Column(db.Boolean())
         confirmed_at = db.Column(db.DateTime())
-        authentication_token = db.Column(db.String(255))
         roles = db.relationship('Role', secondary=roles_users,
                                 backref=db.backref('users', lazy='dynamic'))
 
@@ -227,7 +226,6 @@ def create_mongoengine_app(auth_config=None):
         login_count = db.IntField()
         active = db.BooleanField(default=True)
         confirmed_at = db.DateTimeField()
-        authentication_token = db.StringField(max_length=255)
         roles = db.ListField(db.ReferenceField(Role), default=[])
 
     app.security = Security(app, MongoEngineUserDatastore(db, User, Role))

flask_security/core.py

@@ -88,11 +88,9 @@ def _user_loader(user_id):
 
 
 def _token_loader(token):
-    try:
-        data = _security.remember_token_serializer.loads(token)
-        return _security.datastore.find_user(email=md5(data[0]))
-    except:
-        return None
+    data = _security.remember_token_serializer.loads(token)
+    user = _security.datastore.find_user(id=data[0])
+    return user if md5(user.password) == data[1] else None
 
 
 def _identity_loader():
@@ -171,7 +169,7 @@ class UserMixin(BaseUserMixin):
 
     def get_auth_token(self):
         """Returns the user's authentication token."""
-        data = [md5(self.email), self.password]
+        data = [str(self.id), md5(self.password)]
         return _security.remember_token_serializer.dumps(data)
 
     def has_role(self, role):

flask_security/decorators.py

@@ -54,15 +54,15 @@ def _check_token():
     header_token = request.headers.get(header_key, None)
     token = request.args.get(args_key, header_token)
 
-    serializer = _security.token_auth_serializer
+    serializer = _security.remember_token_serializer
 
     try:
         data = serializer.loads(token)
-        _security.datastore.find_user(id=data[0], authentication_token=token)
-    except BadSignature:
+        user = _security.datastore.find_user(id=data[0])
+    except:
         return False
 
-    return True
+    return True if utils.md5(user.password) == data[1] else False
 
 
 def _check_http_auth():

flask_security/utils.py

@@ -41,9 +41,6 @@ def login_user(user, remember=True):
     if not _login_user(user, remember):
         return False
 
-    if user.authentication_token is None:
-        user.authentication_token = generate_authentication_token(user)
-
     if _security.trackable:
         old_current, new_current = user.current_login_at, datetime.utcnow()
         user.last_login_at = old_current or new_current
@@ -90,15 +87,6 @@ def encrypt_password(password, salt=None, use_hmac=False):
     return _pwd_context.encrypt(hmac_value)
 
 
-def generate_authentication_token(user):
-    """Generates a unique authentication token for the specified user.
-
-    :param user: The user to work with
-    """
-    data = [str(user.id), md5(user.email)]
-    return _security.token_auth_serializer.dumps(data)
-
-
 def md5(data):
     return hashlib.md5(data).hexdigest()
 

flask_security/views.py

@@ -44,7 +44,7 @@ def _json_auth_ok(user):
         "response": {
             "user": {
                 "id": str(user.id),
-                "authentication_token": user.authentication_token
+                "authentication_token": user.get_auth_token()
             }
         }
     })