title: How to use Flask-Login when user info provide by remote service?
body: <p>I'm building a Flask app and started using Flask-Login for authentication.  What troubles me is that Flask-Login calls the load_user callback for <em>every</em> request that flask handles.  Here is the example from <a href="https://flask-login.readthedocs.org/en/latest/#how-it-works" rel="nofollow">https://flask-login.readthedocs.org/en/latest/#how-it-works</a>:</p>
  
  <pre><code>@login_manager.user_loader
  def load_user(userid):
      return User.get(userid)
  </code></pre>
  
  <p>To retrieve the user, I need to pass a session token a remote web service across a VPN, and the remote web service does a db query -- this results in noticeable latency on every web request.  My load_user looks something like this:</p>
  
  <pre><code>@login_manager.user_loader
  def load_user(userid):
      # notice that I don't even use the userid arg
      try:
          # have to get session_token from session; why not 
          # just get the entire user object from session???
          token = session.get('session_token')
          user_profile = RestClient().get_user_profile(token)
          return User(user_profile['LDAP_ID'])
      except:
          return None
  </code></pre>
  
  <p>Seems like maybe I'm subverting the framework.  Could just store/retrieve user from session, so why bother to get it from the web service?  This option also seems to subvert Flask-Login, but eliminates latency and makes good use of session.  </p>