maxcountryman/flask-seasurf — pull request #29 by zdexter (2013-04-20 02:41:15+00:00)
Title: Remove Jinja2 dependency for better AJAX support

Currently, flask-seasurf will only send the client a cookie containing a CSRF token if someone has called the _get_token() function, usually from a Jinja2 view.

If you are doing AJAX requests and don't use the Jinja2 tag ( {{ csrf_token }} ) - that is, if you just want to use the value in the cookie, this change lets you do that.

It adds a bit of the request context into the application global `g` so that the response can know whether or not it should include a cookie. I thought that it would be reasonable to set the cookie on the response if the page should be protected per the app config.

Because all views that are protected per the config can now get the cookie upon render, there is no need to check and see if someone actually used the csrf_token tag. Previously, the 'used' flag was never set, meaning the cookie never got set.