CSRF protection in Flask - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the main purpose of CSRF protection in Flask?

CSRF protection is important in web applications. What does it mainly protect against?

A It validates user input to prevent SQL injection.

B It encrypts user passwords before storing them in the database.

C It blocks all external requests to the server.

D It prevents attackers from tricking users into submitting unwanted requests to a web application.

💡 Hint

Think about what kind of attack involves making a user unknowingly perform actions.

CSRF protection stops attackers from making users submit forms or requests without their consent, protecting user actions.

❓ component_behavior

intermediate

What happens if a Flask form is submitted without a valid CSRF token?

Consider a Flask app using Flask-WTF with CSRF protection enabled. What is the typical behavior when a form is submitted without a valid CSRF token?

A The form submission is accepted but logged as suspicious.

B The server raises a <code>CSRFError</code> and rejects the request.

C The server ignores the CSRF token and processes the form normally.

D The server redirects the user to the homepage without processing the form.

💡 Hint

Think about how Flask-WTF handles invalid CSRF tokens by default.

Flask-WTF raises a CSRFError exception and rejects the form submission if the CSRF token is missing or invalid.

📝 Syntax

advanced

Which code snippet correctly adds CSRF protection to a Flask app using Flask-WTF?

Choose the correct code to enable CSRF protection in a Flask app using Flask-WTF.

Flask

from flask import Flask
from flask_wtf.csrf import CSRFProtect

app = Flask(__name__)
app.config['SECRET_KEY'] = 'your-secret-key'

# Add CSRF protection here

A

csrf = CSRFProtect()
csrf.init_app(app)

B csrf = CSRFProtect(app)

C

csrf = CSRFProtect(app)
app.config['WTF_CSRF_ENABLED'] = False

D

csrf = CSRFProtect()
app.csrf = csrf

💡 Hint

Remember that CSRFProtect can be initialized without app and then linked.

Option A correctly creates a CSRFProtect instance and initializes it with the Flask app using init_app. Option A works but is less flexible. Option A disables CSRF. Option A does not properly initialize CSRF.

🔧 Debug

advanced

Why does this Flask form raise a CSRF error despite using Flask-WTF?

Given this Flask-WTF form and template, the form submission raises a CSRF error. What is the likely cause?

Flask

class MyForm(FlaskForm):
    name = StringField('Name')
    submit = SubmitField('Submit')

# Template snippet:
# <form method="POST">
#   {{ form.name.label }} {{ form.name() }}
#   {{ form.submit() }}
# </form>

A The form method should be GET instead of POST.

B The form class does not inherit from FlaskForm.

C The form is missing the CSRF token field in the template.

D The submit button is missing a name attribute.

💡 Hint

Check if the CSRF token field is included in the HTML form.

Flask-WTF requires the CSRF token field to be rendered inside the form. Without {{ form.csrf_token }}, the token is not sent, causing a CSRF error.

❓ state_output

expert

What is the output of this Flask route with CSRF protection when submitting a form without a token?

Consider this Flask route using Flask-WTF with CSRF protection enabled. What response does the user get if the form is submitted without a CSRF token?

Flask

from flask import Flask, render_template_string
from flask_wtf import FlaskForm
from flask_wtf.csrf import CSRFProtect
from wtforms import StringField, SubmitField

app = Flask(__name__)
app.config['SECRET_KEY'] = 'secret'
csrf = CSRFProtect(app)

class TestForm(FlaskForm):
    name = StringField('Name')
    submit = SubmitField('Send')

@app.route('/', methods=['GET', 'POST'])
def index():
    form = TestForm()
    if form.validate_on_submit():
        return 'Form submitted'
    return render_template_string('''
        <form method="POST">
            {{ form.csrf_token }}
            {{ form.name.label }} {{ form.name() }}
            {{ form.submit() }}
        </form>
    ''', form=form)

# If a POST request is sent without CSRF token, what happens?

A The server returns a 400 Bad Request error with a CSRF error message.

B The server accepts the form and returns 'Form submitted'.

C The server redirects to the GET route without error.

D The server crashes with an unhandled exception.

💡 Hint

Think about how Flask-WTF handles missing CSRF tokens on POST requests.

Flask-WTF raises a 400 Bad Request error with a CSRF error message when the CSRF token is missing or invalid on POST requests.