Humm I had to add keepvalues=True (there could be an auth.settings.keepvalues) to the form.accepts and remove the redirect replacing it with a return form.
Basically: if form.accepts(request, session if self.csrf_prevention else None, formname='login', dbio=False, onvalidation=onvalidation, hideerror=settings.hideerror, keepvalues=True): (....) if not user: self.log_event(self.messages['login_failed_log'], request.post_vars) # invalid login session.flash = self.messages.invalid_login callback(onfail, None) #redirect( # self.url(args=request.args, vars=request.get_vars), # client_side=settings.client_side) return form Why are we redirecting anyway? -- Resources: - http://web2py.com - http://web2py.com/book (Documentation) - http://github.com/web2py/web2py (Source code) - https://code.google.com/p/web2py/issues/list (Report Issues) --- You received this message because you are subscribed to the Google Groups "web2py-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to web2py+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.