5 ms·
Most people who use Flask are also using Flask-WTF for their forms, and the default "FlaskForm" object exposed by it uses CSRF tokens by default.
by tedivm 5y ago
Most people who use Flask are also using Flask-WTF for their forms, and the default "FlaskForm" object exposed by it uses CSRF tokens by default.
- BiteCode_dev 5y agoLast month flask has been downloaded 45 177 334 times, flask-wtf 3 466 675 times. That's 7%.
- yes_man 5y ago1. Not all servers serve web pages. As for how big percentage of Flask users thus don’t need CSRF is hard to guess 2. WTForms is not the only way to do CSRF tokens with Flask My point is that it’s not plausible to infer with certainty that some large part of Flask users would not have CSRF tokens just because Flask has more downloads than Flask-WTF
- wink 5y agoJust anecdata but me (and my team back then) used Flask for years, I'm pretty sure zero of our apps even had a form for users to interact with. It used to be very popular for REST APIs.
- nickjj 5y agoIndeed, you can also create a Jinja macro to auto-insert the token into all of your forms too, here's a code example[0]. It's a 100% solved problem both on the Flask back-end and template side with an ability to opt out of it when you need to on the back-end such as when accepting webhooks from another service. [0]: https://github.com/nickjj/build-a-saas-app-with-flask/blob/1c135c22c0724d50f6b506e8426dc7f58632fdf3/snakeeyes/templates/macros/form.html#L52 https://github.com/nickjj/build-a-saas-app-with-flask/blob/1...