Flask-Restful POST fails due CSRF protection of Flask-WTF

python rest flask flask-wtforms flask-restful
Houman picture Houman · Feb 2, 2014 · Viewed 9.6k times · Source

I am using normal flask web + flask-restful. So I need CSRF protection for web but not for REST.

The moment I enable CsrfProtect(app) of flask-wtf, all my post unit tests for flask-restful return a 400.

Is there a way to disable CSRF protection for REST services since they are coming from mobile handsets without session handling anyway, hence CSRF wouldn't make much sense.

This is how I test it:

rv = self.client.post('api/v1.0/verify-email', environ_base={'REMOTE_ADDR': '127.0.0.1'}, headers={'Content-Type':'application/json'}, data=json.dumps(data))
self.check_content_type(rv.headers)
eq_(rv.status_code, 412)

Answer

Martijn Pieters picture Martijn Pieters · Feb 2, 2014

You can use the @csrf.exempt decorator, which you need to add directly on the API object, with the decorators argument; this would apply the decorator to all API routes:

csrf_protect = CsrfProtect(app)
api = restful.Api(app, decorators=[csrf_protect.exempt])

You cannot use resource method decorators as they are not the final view functions that the exempt decorator requires to work.

It appears you cannot protect individual resources and exempt others; this is a limitation in the method used by Flask-Wtf's method of recording what views are exempted.

Related questions

Flask example with POST

Suppose the following route which accesses an xml file to replace the text of a specific tag with a given xpath (?key=): @app.route('/resource', methods = ['POST']) def update_text(): # CODE Then, I would use cURL like this: curl …

Read More
How can I add a background thread to flask?

I'm busy writing a small game server to try out flask. The game exposes an API via REST to users. It's easy for users to perform actions and query data, however I'd like to service the "game world" outside the …

Read More
flask restful: passing parameters to GET request

I want to create a resource that supports GET request in following way: /bar?key1=val1&key2=val2 I tried this code, but it is not working app = Flask(__name__) api = Api(app) class BarAPI(Resource): def get(key1, …

Read More