Simplify oauth_authorized with redirect

repost from https://github.com/singingwolfboy/flask-dance/issues/203#issuecomment-486333141 (CC @daenney @singingwolfboy) Right now the expectation is that writers of oauth_authorized callbacks handle saving the token if they want a redirect. This leads to more complicated logic to handle redirects (see linked comment), reposted here: why push that responsibility on the user? Seems like there is a non trivial amount of logic in setting the token (ie handling errors) that I would guess most consumers would still want to use.

I think in the base case of just wanting to customize redirects (ie to send the user back to the where they originally came from) where the logic is:

    next_url = flask.session["next_url"]
    return flask.redirect(next_url)

having to also set the token seems unnatural.

I suggest improving the DX here to allow returning the a response and still re-using the existing set token logic.

[singingwolfboy]

The part I’m missing (maybe it’s trivial !) is how do we set the next_url in the flask session?

Doing it in your view code is one way. You could also hook into the oauth_before_login signal:

import flask
from flask_dance.consumer import oauth_before_login

@oauth_before_login.connect
def before_login(blueprint, url):
    flask.session["next_url"] = flask.request.args.get("next_url")

[daenney]

Yup, that ought to do the trick. One additional tip, when doing the redirect it’s probably good to do:

next_url = flask.session.pop("next_url", "")
if next_url:
  return redirect...
return redirect(url_for("/")) # any named route, homepage etc

Alternatively, you can set the default argument to .pop("next_url", "app.index") to avoid the if next_url check and always redirect.

By using .pop you remove the value from the session. There’s no need to keep it around anymore and avoids it still being accidentally set and causing surprises if/when a user re-authenticates.