CSRF protection concept in Flask - Step-by-Step Execution

Concept Flow - CSRF protection concept

User visits form page

↓

Server generates CSRF token

↓

Token included in form as hidden field

↓

User submits form with token

↓

Server checks token validity

↓

Process form

↓

Response

This flow shows how a CSRF token is created, sent with a form, and verified on submission to protect against unauthorized requests.

Execution Sample

Flask

from flask import Flask
from flask_wtf import FlaskForm
from wtforms import StringField, SubmitField
from flask_wtf.csrf import CSRFProtect

app = Flask(__name__)
app.config['SECRET_KEY'] = 'your_secret_key'

csrf = CSRFProtect(app)

class MyForm(FlaskForm):
    name = StringField('Name')
    submit = SubmitField('Submit')

This code sets up CSRF protection in Flask and creates a form that includes a CSRF token automatically.

Execution Table

Step	Action	Token Generated	Token Sent in Form	Token Received	Token Valid?	Result
1	User requests form page	Yes (new token)	Token included in form HTML	N/A	N/A	Form page sent with token
2	User fills form and submits	N/A	Token sent with form data	Token received from form	Checked	If valid, process form
3	Server verifies token	N/A	N/A	Token matches server token	Yes	Form data accepted
4	Server verifies token	N/A	N/A	Token missing or wrong	No	Request rejected with error

💡 Execution stops after form is accepted or rejected based on token validity.

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	Final
csrf_token	None	Generated (random string)	Sent in form	Received from form	Validated or rejected
form_data	None	None	User input + token	Processed if token valid	Stored or error

Key Moments - 3 Insights

Why do we need to include the CSRF token in the form?

Including the token in the form (see execution_table step 1) ensures the server can verify the request came from the original site, preventing attackers from forging requests.

What happens if the token is missing or incorrect?

As shown in execution_table step 4, the server rejects the request to protect against unauthorized actions.

Is the CSRF token the same for every user or request?

The token is unique per user session and often per request (step 1), so attackers cannot guess it.

Visual Quiz - 3 Questions

Look at the execution_table, at which step is the CSRF token first generated?

A Step 2

B Step 1

C Step 3

D Step 4

💡 Hint

Check the 'Token Generated' column in the execution_table.

According to variable_tracker, what happens to csrf_token after Step 3?

A It is discarded

B It is sent to the user again

C It is validated or rejected

D It becomes None

💡 Hint

Look at the 'csrf_token' row and the 'After Step 3' and 'Final' columns.

If the token is missing in the form submission, what does the server do according to execution_table?

A Rejects the request with an error

B Generates a new token and accepts

C Processes the form normally

D Ignores the token and continues

💡 Hint

See the 'Token Valid?' and 'Result' columns in step 4 of execution_table.

Concept Snapshot

CSRF protection in Flask:
- Server creates a unique token per user session
- Token included as hidden field in forms
- On form submit, server checks token matches
- If valid, process form; if not, reject
- Prevents attackers from forging requests

Full Transcript

CSRF protection works by generating a secret token on the server when a user requests a form page. This token is included inside the form as a hidden field. When the user submits the form, the token is sent back to the server. The server then checks if the token matches the one it created. If the token is valid, the server processes the form data. If the token is missing or incorrect, the server rejects the request to prevent unauthorized actions. This protects users from attackers who try to trick them into submitting forms without their knowledge.