如何对单页应用程序使用Flask-WTF CSRF保护？

Question

I noticed that tokens generated by Flask-WTF expire in one hour and a different one is generated every request. This will cause problems in SPAs when a page has been opened longer than an hour. XHR requests made after one hour after page-load will start failing, even if the user was active.

My workaround is to set a new token in the browser in each API call. In the server, all API responses contain a freshly-generated token:

from flask_wtf.csrf import generate_csrf

def api_response(data, error=None):
    response = {"csrftoken": generate_csrf(), "data":data}
    ...
    return make_response(jsonify(response), response_code)

In the browser we set the csrftoken on each API response.

then(function(result) {
    if(result.csrftoken) csrftoken=result.csrftoken;
    callback(result);
  })

Is this method still safe and fast? Is there a better way to handle this? I am not too sure about using generate_csrf directly.

Answer 1

No, there is no other way to use the CSRF protection in Flask-WTF. When you need a CSRF token, you need to generate one and use it. There should be no problem with generating it like you do. It is still generated and validated the same way on the server, and transmitted over the same channel to the client.