使用CSRF保护与WTForms-Alchemy

Question

I have a web application with 3 forms. 2 inherit from flask_wtf.form.Form which by itself inhertis from WTForms SecureForm. This means these forms have automatic CSRF protection.

The 3rd form inherits its properties from a model object and as such inherits from wtforms_alchemy.ModelForm which by itself inherits from wtforms.Form.

How can I add CSRF protection to this last form?

Answer 1

What worked for me was mixing in Form from flask_wtf package.

from flask_wtf import Form

class YourForm(ModelForm, Form):

Results in also have a valid hidden CSRF token.

Answer 2

What worked for me was mixing in configure flask_wtf.csrf from flask_wtf package.

py

from flask_wtf.csrf import CSRFProtect
....
csrf = CSRFProtect(app)

class UserForm(ModelForm):
    class Meta:
       model = User
....

userform = UserForm()

html

<form method="post">
  {{ userform.csrf_token }}
  {{ userform.userform }}
  <input type="submit" name="submit">   
</form>

Results in also have a valid hidden CSRF token.