maxcountryman/flask-seasurf — Issue #2: Python 2.6
Author: gillestasse
Created: 2012-02-19 14:10:13+00:00
State: open

SeaSurf is a Flask extension for preventing cross-site request forgery (CSRF).

CSRF vulnerabilities have been found in large and popular sites such as YouTube. These attacks are problematic because the mechanism they use is relatively easy to exploit. This extension attempts to aid you in securing your application from such attacks.

This extension is based on the excellent Django middleware.

If you are running under python2.7, you will get the following error :

return str(hashlib.sha1('{}{}'.format(*salt)).hexdigest())
ValueError: zero length field name in forma

This is due to the fact that Flask-seasurf has been developped with python2.7.

Quoting stackoverflow (tinyurl.com/6r86x76) answer :

Python 2.6 requires the field numbers. In Python 2.7 and later, they can be omitted.

Changed in version 2.7: The positional argument specifiers can be omitted, so '{} {}' is equivalent to '{0} {1}'.

To fix the error edit the seasurf.py and the method _generate_token()

replace hashlib.sha1('{}{}'.format(*salt)).hexdigest() by hashlib.sha1('{0}{1}'.format(*salt)).hexdigest()