CSRF protection concept in Flask - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does CSRF stand for and what is it?

CSRF stands for Cross-Site Request Forgery. It is a type of attack where a bad website tricks a user's browser into making unwanted actions on a trusted site where the user is logged in.

beginner

How does Flask help protect against CSRF attacks?

Flask uses a CSRF token, a secret value sent with forms. The server checks this token on form submission to make sure the request is from the real user, not a fake site.

beginner

What is a CSRF token and why is it important?

A CSRF token is a unique, secret value generated by the server and included in forms. It helps confirm that the form submission is genuine and not forged by another site.

intermediate

Which Flask extension is commonly used to add CSRF protection?

Flask-WTF is a popular extension that adds CSRF protection automatically by generating and validating CSRF tokens in forms.

beginner

Why is it important to include CSRF protection in web forms?

Without CSRF protection, attackers can trick users into submitting forms unknowingly, causing unwanted actions like changing passwords or making purchases.

What does a CSRF token do in a Flask app?

A Verifies that form submissions come from the real user

B Encrypts user passwords

C Stores user session data

D Prevents SQL injection attacks

A CSRF token confirms that the form submission is genuine and not forged by another site.

Which Flask extension helps with CSRF protection?

A Flask-Login

B Flask-SQLAlchemy

C Flask-WTF

D Flask-Migrate

Flask-WTF automatically adds CSRF tokens to forms and validates them.

CSRF attacks happen because:

A Forms use GET instead of POST

B Users forget their passwords

C Servers do not encrypt data

D Browsers trust requests from logged-in users without extra checks

Browsers send cookies automatically, so attackers can trick browsers into sending unwanted requests if no CSRF protection exists.

What must a server check to prevent CSRF?

A User's IP address

B Presence and validity of CSRF token

C User's browser type

D Form field lengths

The server checks the CSRF token to confirm the request is legitimate.

Which HTTP method is most commonly protected by CSRF tokens?

A POST

B GET

C HEAD

D OPTIONS

POST requests change data and are protected by CSRF tokens to prevent forged submissions.

Explain in simple terms what CSRF protection is and why it matters in Flask web apps.

Think about how a bad website might trick a logged-in user to do something unwanted.

Describe how to add CSRF protection to a Flask form using Flask-WTF.

Focus on the steps to set up and use the extension.