CSRF protection concept in Flask - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the main purpose of CSRF protection in Flask?

CSRF protection is important in web applications. What does it mainly prevent?

A It prevents attackers from submitting forms on behalf of authenticated users without their consent.

B It stops users from entering invalid data in forms.

C It encrypts user passwords before storing them in the database.

D It blocks all external requests to the Flask server.

💡 Hint

Think about what happens if a malicious site tricks a logged-in user into submitting a form.

CSRF protection stops unauthorized commands sent from a user’s browser without their knowledge, protecting user actions.

❓ component_behavior

intermediate

What happens if a Flask form is submitted without a valid CSRF token?

Consider a Flask app using Flask-WTF with CSRF enabled. What is the typical behavior when a form is submitted without the correct CSRF token?

A The server ignores the CSRF token and logs a warning but processes the form.

B The form submission is accepted and processed normally.

C The server raises a <code>CSRFError</code> and rejects the request.

D The server redirects the user to the homepage without any message.

💡 Hint

CSRF protection is designed to block suspicious requests.

Flask-WTF raises a CSRFError when the token is missing or invalid, stopping the form processing.

📝 Syntax

advanced

Which Flask code snippet correctly enables CSRF protection using Flask-WTF?

Choose the code that properly sets up CSRF protection in a Flask app using Flask-WTF.

Flask

from flask import Flask
from flask_wtf import CSRFProtect

app = Flask(__name__)
app.config['SECRET_KEY'] = 'secret!'

# Which line correctly enables CSRF protection?

A csrf = CSRFProtect(app)

B

csrf = CSRFProtect(app)
app.csrf = csrf

C

csrf = CSRFProtect()
csrf.init_app(app)

D

app.csrf = CSRFProtect(app)
csrf.init_app(app)

💡 Hint

Check how the CSRFProtect object is created and linked to the app.

Both creating CSRFProtect with the app as an argument or creating it first and then calling init_app(app) are valid patterns.

🔧 Debug

advanced

Why does this Flask form raise a CSRF error despite using Flask-WTF?

Given this Flask form code, why might a CSRF error occur?

Flask

from flask_wtf import FlaskForm
from wtforms import StringField, SubmitField

class MyForm(FlaskForm):
    name = StringField('Name')
    submit = SubmitField('Send')

# In the template:
# <form method="POST">
#   {{ form.name.label }} {{ form.name() }}
#   {{ form.submit() }}
# </form>

A The form uses GET method instead of POST.

B The template is missing the {{ form.csrf_token }} field inside the form.

C The form class does not inherit from FlaskForm.

D The submit button is not named 'submit'.

💡 Hint

CSRF token must be included in the form HTML.

Flask-WTF requires the CSRF token field to be rendered inside the form for validation.

❓ state_output

expert

What is the output of this Flask route when CSRF token is missing in POST request?

Consider this Flask route using Flask-WTF CSRF protection. What response will the client receive if the POST request lacks a CSRF token?

Flask

from flask import Flask, request
from flask_wtf import CSRFProtect

app = Flask(__name__)
app.config['SECRET_KEY'] = 'secret!'
csrf = CSRFProtect()
csrf.init_app(app)

@app.route('/submit', methods=['POST'])
def submit():
    return 'Form submitted successfully'

# Client sends POST to /submit without CSRF token.

A HTTP 400 Bad Request with a CSRF error message.

B HTTP 200 OK with 'Form submitted successfully'.

C HTTP 500 Internal Server Error due to missing token.

D HTTP 302 Redirect to the login page.

💡 Hint

CSRFProtect blocks requests missing valid tokens with a specific error code.

Flask-WTF returns HTTP 400 Bad Request with a CSRF error when token is missing or invalid.