Form validation fails due missing CSRF

by

The Flask-WTF CSRF infrastructure rejects a token if:

  • the token is missing. Not the case here, you can see the token in the form.

  • it is too old (default expiration is set to 3600 seconds, or an hour). Set the TIME_LIMIT attribute on forms to override this. Probably not the case here.

  • if no 'csrf_token' key is found in the current session. You can apparently see the session token, so that’s out too.

  • If the HMAC signature doesn’t match; the signature is based on the random value set in the session under the 'csrf_token' key, the server-side secret, and the expiry timestamp in the token.

Having eliminated the first three possibilities, you need to verify why the 4th step fails. You can debug the validation in flask_wtf/csrf.py file, in the validate_csrf() function.

For your setup, you need to verify that the session setup is correct (especially if you don’t use the default session configuration), and that you are using the correct server-side secret. The form itself could have a SECRET_KEY attribute set but is not stable across requests, or the app WTF_CSRF_SECRET_KEY key has changed (the latter defaults to the app.secret_key value).

The CSRF support was added in version 0.9.0, do check out the specific CSRF protection documentation if you upgraded. The standard Flask-WTF Form class includes the CSRF token as a hidden field, rendering the hidden fields is enough to include it:

{{ form.hidden_tag() }}

More Related Contents:

  1. Sending data from HTML form to a Python script in Flask
  2. What is the cause of the Bad Request Error when submitting form in Flask application?
  3. Form sending error, Flask
  4. Flask view shows 400 error instead of template with form
  5. Method Not Allowed flask error 405
  6. Flask-WTF – validate_on_submit() is never executed
  7. Clear valid form after it is submitted
  8. Determine which WTForms button was pressed in a Flask view
  9. Form is never valid with WTForms
  10. Dynamic choices WTForms Flask SelectField
  11. How to serve static files in Flask
  12. Flask view return error “View function did not return a response”
  13. How do I get the different parts of a Flask request’s url?
  14. Why use Flask’s url_for?
  15. Remove file after Flask serves it
  16. Making an asynchronous task in Flask
  17. Send data from a textbox into Flask?
  18. Serve image stored in SQLAlchemy LargeBinary column
  19. Create dynamic arguments for url_for in Flask
  20. IOError: [Errno 13] Permission denied: ‘geckodriver.log when running Python/Selenium
  21. Querying with function on Flask-SQLAlchemy model gives BaseQuery object is not callable error
  22. Flask broken pipe with requests
  23. Django equivalent of PHP’s form value array/associative array
  24. flask does not see change in .js file
  25. Get multiple request params of the same name
  26. Flask app that routes based on subdomain
  27. Flask Config File – ‘DEBUG=True’ Do Nothing
  28. Flask, SQLAlchemy : KeyError: ‘SQLALCHEMY_TRACK_MODIFICATIONS’
  29. Tyring to set up modelview with Flask-Admin causes ImportError
  30. import function from a file in the same folder

Leave a Comment