<p>I have a weird problem with PGAdmin4.</p>

<p><strong>My setup</strong></p>

<ul>
<li><code>pgadmin</code> 4.1 deployed on <code>kubernetes</code> using the <code>chorss/docker-pgadmin4</code> image. One POD only to simplify troubleshooting;</li>
<li><code>Nginx ingress controller</code> as reverse proxy on the cluster;</li>
<li><code>Classic ELB</code> in front to load balance incoming traffic on the cluster.</li>
</ul>

<p><code>ELB &lt;=&gt; NGINX &lt;=&gt; PGADMIN</code></p>

<p>From a DNS point of view, the hostname of pgadmin is a CNAME towards the ELB.</p>

<p><strong>The problem</strong></p>

<p>Application is correctly reachable, users can login and everything works just fine. Problem is that after a couple of (roughly 2-3) minutes the session is invalidated and users are requested to login again. This happens regardless of the fact that pgadmin is actively used or not.</p>

<p>After countless hours of troubleshooting, I found out that the problem happens when the DNS resolution of ELB's CNAME switches to another IP address.</p>

<p>In fact, I tried:</p>

<ul>
<li>connecting to the pod directly by connecting to the <code>k8s service</code>'s node port directly => session doesn't expire;</li>
<li>connecting to <code>nginx</code> (bypassing the ELB) directly => session doesn't expire;</li>
<li>mapping one of the ELB's IP addresses in my hosts file => session doesn't expire.</li>
</ul>

<p>Given the above test, I'd conclude that the Flask app (PGAdmin4 is a Python Flask application apparently) is considering my cookie invalid after the remote address changes for my hostname.</p>

<p>Any Flask developer that can help me fix this problem? Any other idea about something I might be missing?</p>

<p>PGadmin 4 seems to use Flask-Security for authentication:</p>

<blockquote>
  <p>pgAdmin utilised the Flask-Security module to manage application security and users, and provides options for self-service password reset and password changes etc.</p>
</blockquote>

<p><a href="https://www.pgadmin.org/docs/pgadmin4/dev/code_overview.html" rel="nofollow noreferrer">https://www.pgadmin.org/docs/pgadmin4/dev/code_overview.html</a></p>

<p>Flask-Security seems to use Flask-Login:</p>

<blockquote>
  <p>Many of these features are made possible by integrating various Flask extensions and libraries. They include:
  Flask-Login
  ...</p>
</blockquote>

<p><a href="https://pythonhosted.org/Flask-Security/" rel="nofollow noreferrer">https://pythonhosted.org/Flask-Security/</a></p>

<p>Flask-Login seems to have a feature called "session protection":</p>

<blockquote>
  <p>When session protection is active, each request, it generates an identifier for the user’s computer (basically, a secure hash of the IP address and user agent). If the session does not have an associated identifier, the one generated will be stored. If it has an identifier, and it matches the one generated, then the request is OK.</p>
</blockquote>

<p><a href="https://flask-login.readthedocs.io/en/latest/#session-protection" rel="nofollow noreferrer">https://flask-login.readthedocs.io/en/latest/#session-protection</a></p>

<p>I would assume setting <code>login_manager.session_protection = None</code> would solve the issue, but unfortunately I don't know how to set it in PGadmin. Hope it might help you somehow.</p>
