Flask POST Redirect: Parameters showing up in address bar

Question

Setup:

1. Flask web app.
2. User navigates to one of multiple pages [e.g. game page (localhost:5000/game) or players page (localhost:5000/players)] through a post request with GAME_ID in the form. GAME_ID is used to fetch additional details and render the page.

Objective:

1. When an unauthenticated users makes a post request to /game, redirect them to the /login page but retain the endpoint (game) and the GAME_ID in the session, so that on successful login, I can send them back to the page they were accessing. My approach was to make a 307 redirect.

Approach (based on this and this):

In application.py

@login_manager.unauthorized_handler
def intercept_unauthorized():
    <Set NEXT_PAGE_FOR_REDIRECT and GAME_ID_FOR_REDIRECT into the session>
    return redirect(url_for('login'))

@application.route("/login", methods=['GET', 'POST'])
def login():
    #User sees the login page
    if request.method=='GET':
      <show the login page>
    
    #User has submitted username and password on the login page
    elif request.method=='POST':
      <authentication code here>
      if validUser:
          #Get the page the user was trying to access e.g. 'game'
          nextPage = session.get('NEXT_PAGE_FOR_REDIRECT')
          session.pop('NEXT_PAGE_FOR_REDIRECT')
          gameID = session.get('GAME_ID_FOR_REDIRECT')        
          session.pop('GAME_ID_FOR_REDIRECT')

          return redirect(url_for(next_page, gameID=gameID), code=307)

@application.route("/game", methods=['POST'])
@login_required
def game():
    if 'gameID' in request.form:
        render_template('game.html', gameID=request.form['gameID'])

Issue:

1. I am able to redirect to /game where request.method is POST. But, the data in request.form is the data submitted from the login page submit i.e. username and password.
2. I am able to access the gameID I set in the url_for line, but it is sent in request.args (and is visible in the browser's address bar) instead of through request.form.

Questions:

1. Is my approach of using a redirect correct?
2. How can I modify the form being sent to /game so that I can add gameID to it?

Answer 1

From: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/307

HTTP 307 Temporary Redirect redirect status response code indicates that the resource requested has been temporarily moved to the URL given by the Location headers.

The method and the body of the original request are reused to perform the redirected request. In the cases where you want the method used to be changed to GET, use 303 See Other instead. This is useful when you want to give an answer to a PUT method that is not the uploaded resources, but a confirmation message (like "You successfully uploaded XYZ").

The only difference between 307 and 302 is that 307 guarantees that the method and the body will not be changed when the redirected request is made.

So, the original request.form is retained. You could just use the session to display the hidden ID, like:

@application.route("/game", methods=['POST'])
@login_required
def game():
    gameID = session.get('GAME_ID_FOR_REDIRECT')        
    session.pop('GAME_ID_FOR_REDIRECT')
    render_template('game.html', gameID=gameID )

Of course, you'd have to remove the pop() from login()