An error occurs when accessing /users/userinfo/ after deleting a user:AttributeError: 'AnonymousUserMixin' object has no attribute 'id'

[moshhi]

error detail:
2025-06-19 17:36:36,952:WARNING:superset.views.error_handling:Exception
Traceback (most recent call last):
File "/home/ubuntu/venv/lib/python3.10/site-packages/flask/app.py", line 1484, in full_dispatch_request
rv = self.dispatch_request()
File "/home/ubuntu/venv/lib/python3.10/site-packages/flask/app.py", line 1469, in dispatch_request
return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args)
File "/home/ubuntu/venv/lib/python3.10/site-packages/flask_appbuilder/security/decorators.py", line 151, in wraps
return f(self, *args, **kwargs)
File "/home/ubuntu/venv/lib/python3.10/site-packages/flask_appbuilder/security/views.py", line 287, in userinfo
item = self.datamodel.get(g.user.id, self._base_filters)
AttributeError: 'AnonymousUserMixin' object has no attribute 'id'
How can I fix it? @inclusive-coding-bot

[dosubot[bot]]

This error happens because Flask-AppBuilder's userinfo view doesn't check if the user is anonymous before accessing g.user.id. When you delete a user but the session remains, g.user becomes an AnonymousUserMixin, which lacks an id attribute, causing the AttributeError.

To fix this: log out and log back in, or clear your browser's session cookies to remove any lingering references to the deleted user. If you have custom session or authentication logic, make sure it handles deleted users gracefully. For a more robust fix, consider overriding the FAB userinfo view to check for anonymous users before accessing user attributes, or update FAB if a patch becomes available. More details and workarounds are discussed here.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}   

[moshhi]

"onsider overriding the FAB userinfo view to check for anonymous users before accessing user attributes" how to do this?@dosu

[dosubot[bot]]

To override the Flask-AppBuilder userinfo view and avoid the AttributeError, you can subclass the original view and add a check for anonymous users before accessing user attributes. For example, create a custom view that extends the original, override the userinfo method, and check if g.user is anonymous (using g.user.is_anonymous or hasattr(g.user, "id")). If the user is anonymous, redirect to login or show an error; otherwise, proceed as normal.

Here's a minimal example:

from flask import g, redirect, url_for
from flask_appbuilder.security.views import UserDBModelView

class CustomUserInfoView(UserDBModelView):
    @expose('/userinfo/')
    def userinfo(self):
        if not hasattr(g.user, "id") or getattr(g.user, "is_anonymous", False):
            return redirect(url_for('AuthDBView.login'))
        return super().userinfo()

Then, register this custom view with your appbuilder instance, replacing the default one. This pattern is similar to how custom authentication views are created in Superset and Flask-AppBuilder, as shown in this example.

This approach ensures that if the user is anonymous (for example, after deletion), the code won't try to access attributes that don't exist, preventing the AttributeError.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}