rduplain/flask-wtf — Issue #8: CSRF / reset_csrf documentation when process 2 forms in single view
Author: rduplain
Created: 2012-02-29 16:44:53+00:00
State: open
Labels: bug, import

Assume I have a view like this):

#!python

def myview():
form1 = FormOne()
if form1.validate_on_submit():
form2 = FormTwo()
return render_template("template.html", form=form2)
return do_something_else()

When form1 is processed in validate_on_submit(), the session is updated with a new csrf token. Upon instantiation of FormTwo, csrf_token variable in flaskext.wtf.Form.__init__ is set to the new value (checked with print statement) BUT that new value is not present in form2 afterward - the old value is sticking around causing invalid csrf tokens when form2 is submitted.

I'm not sure how reset_csrf() factors into this... the way I finally got it working was to do this:

#!python

form2 = FormTwo()
form2.csrf.data = form2.csrf_reset()

Not sure I found any good examples of csrf_reset in the docs. Might be a problem between keyboard and chair over here but this just does not feel quite right.

Cheers.

---------------------------------------
- Bitbucket: https://bitbucket.org/danjac/flask-wtf/issue/8
- Originally Reported By: Anonymous
- Originally Created At: 2010-11-17 00:32:46