rduplain/flask-wtf — Issue #4: validate_csrf() causes inconsistent behaviour when calling validate() twice
Author: rduplain
Created: 2012-02-29 16:44:47+00:00
State: open
Labels: bug, import

When calling validate_csrf() on the base Form class the form field is reset with the new token (and the token added to the session). The old session is removed so no token can be used twice.

This works fine, however it causes an inconsistent behaviour if validate() is called twice. This is because the current value of form.data is compared to the current session value, which in this case will always be True after the first call to validate().

While it is unnecessary (and inadvisable) to call validate() twice in a request, behaviour should be consistent.

In order to get round this there needs to be a flag which checks if the CSRF has been checked and validated.

How to reproduce:

class MyForm(Form):
pass

@app.route("/", methods=("POST",))
def submit():
form = MyForm() # form with csrf validation, but csrf not passed in POST
assert not form.validate()
assert not form.validate() # breaks with AssertionError

---------------------------------------
- Bitbucket: https://bitbucket.org/danjac/flask-wtf/issue/4
- Originally Reported By: [Dan Jacob](http://bitbucket.org/danjac)
- Originally Created At: 2010-09-12 12:20:19