Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

More CSRF fixes. #958

Merged
merged 1 commit into from
Mar 21, 2024
Merged

More CSRF fixes. #958

merged 1 commit into from
Mar 21, 2024

Commits on Mar 21, 2024

  1. More CSRF fixes. 

    For application forms (not Flask-Security forms/views) the CSRF_PROTECT_MECHANISMS didn't stop form level CSRF checks.
This PR changes how we communicate to form-based CSRF whether to proceed or not - used to use a FS-specific request attribute - but that only worked with forms instantiated by Flask-Security. Now, use Flask-WTF request attribute `csrf_valid`.

This also simplified the unauth_csrf() decorator so that the 'fall_through' parameter is no longer needed (and uses have been removed).

Add test for @unauth_csrf decorator raising error. Note that this returns a 400 with 'CSRF token is missing' - unlike the normal form-based CSRF check that returns it as a field error.
    @jwag956
    jwag956 committed Mar 21, 2024
    Configuration menu
    Copy the full SHA
    56a5085 View commit details
    Browse the repository at this point in the history