CSRF protection in Flask - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does CSRF stand for and why is it a security concern?

CSRF stands for Cross-Site Request Forgery. It is a security issue where an attacker tricks a user into submitting unwanted actions on a web application where they are authenticated, potentially causing harmful effects without the user's consent.

beginner

How does Flask-WTF help protect against CSRF attacks?

Flask-WTF automatically adds a hidden CSRF token to forms and checks this token on form submission. This token must match the one stored in the user's session, ensuring the request is genuine and not forged.

beginner

What is the role of the CSRF token in form submissions?

The CSRF token is a unique, secret value generated for each user session. It is included in forms and verified on submission to confirm the request comes from the legitimate user, preventing attackers from forging requests.

beginner

Which Flask extension is commonly used to enable CSRF protection easily?

Flask-WTF is the common extension used to enable CSRF protection easily by integrating CSRF tokens into forms and validating them automatically.

intermediate

What must you do in your Flask app to enable CSRF protection with Flask-WTF?

You must set a secret key in your Flask app configuration and initialize the CSRFProtect extension or use FlaskForm from Flask-WTF which handles CSRF tokens automatically.

What is the main purpose of a CSRF token in Flask forms?

A To verify the form was submitted by the authenticated user

B To style the form elements

C To speed up form submission

D To store user passwords

The CSRF token ensures the form submission is from the authenticated user and not from a malicious third party.

Which Flask extension helps you add CSRF protection to your forms easily?

A Flask-WTF

B Flask-SQLAlchemy

C Flask-Migrate

D Flask-Login

Flask-WTF integrates CSRF protection by adding tokens to forms and validating them automatically.

What must be set in your Flask app to enable CSRF protection?

A DEBUG = True

B DATABASE_URI

C SECRET_KEY

D SESSION_COOKIE

A SECRET_KEY is required to securely generate and validate CSRF tokens.

If a CSRF token is missing or invalid, what happens when a form is submitted?

A The form submits normally

B The server rejects the request

C The form data is saved without validation

D The user is redirected to the homepage

The server rejects requests with missing or invalid CSRF tokens to prevent forgery.

CSRF attacks exploit which of the following?

A Database queries

B Browser cache

C CSS styles

D User's authenticated session

CSRF attacks exploit the user's authenticated session to perform unwanted actions.

Explain how CSRF protection works in a Flask web application using Flask-WTF.

Think about the token's journey from server to form and back.

Describe the steps you take to add CSRF protection to a Flask app.

Consider configuration, installation, and template changes.