using flask_wtf.csrf without wtf_forms

user_16820361 0
Viewed 245

I have a simple flask web app and I want to use flask_wtf csrf protection but whenever I try to run to submit the form I get an error saying I am missing the CSRF token.

Is it even possible to use csrf without wtf forms? and if so what am I doing wrong?

my code:

app = Flask(__name__)
csrf = CSRFProtect(app)

@app.route("/reserve", methods=["GET", "POST"])
def reserve():
   if request.method == "GET" :
       return render_template("reserve.html", **context)


<form id="Reserve" action="/reserve" method="post">
   <!-- csrf protection -->
   <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
   <input type="text" placeholder="Name">
   <button type="submit">
        Submit
   </button>
</form>
flask-wtforms flask jinja2 html python
1 Answers

Looking your code, you need to init app with csfr, an example below:

from flask_wtf.csrf import CSRFProtect
from flask import Flask,render_template,request,redirect
app = Flask(__name__)
csrf = CSRFProtect(app)
csrf.init_app(app)
app.config['SECRET_KEY'] = 'SUPER SECRET KEY TEST'
@app.route("/reserve", methods=["GET", "POST"])
def reserve():
    context = {
        'gh':'as' 
    }
    if request.method == "GET" :
       return render_template("reserve.html", **context)
    
    else:
        user = request.form['ssss']
        return 'USER : '+user
@app.route("/")
def index():
    return redirect('/reserve')

and html


<form id="Reserve" action="/reserve" method="post">
   <!-- csrf protection -->
   <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
   <input type="text" placeholder="Name" name='ssss'>
   <button type="submit">
        Submit
   </button>
</form>
user_138880360
Related