mattupstate/flask-security — pull request #138 by joeyespo (2013-07-23 03:46:48+00:00)
Title: Ignore validation errors in find_user

I hit an interesting corner-case while developing two Flask projects that use Flask-Security. In one project, I'm using Postgresql and in the second, MongoEngine. The session contains a `user_id` of the last logged-in user and every time I switch from the Postgres project to MongoEngine, I see a `ValidationError` when viewing any page until I manually clear the session.

The error was vague, showing me just that `u'1'` was not the expected `ObjectId` type. After some digging, I noticed that ID originated from the session. This change allows you to skip the manual process of deleting the session cookie, assuming you've seen this before and know that's what you need to do.

Semantically, Flask-Login shouldn't fail when looking for a user that comes from the session, since there's no such user of an invalid user string. I initially thought I'd address this there, or in core.py's `_user_loader` function, but then that code needs to know which database or `Datastore` you're using.