CSRF protection in Flask - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to import the CSRF protection extension in Flask.

Flask

from flask_wtf import [1]

Drag options to blanks, or click blank then click option'

AFlaskForm

BCSRFProtect

Crender_template

DFlask

Attempts:

3 left

💡 Hint

Common Mistakes

Importing FlaskForm instead of CSRFProtect

Importing render_template which is unrelated

Importing Flask which is the main framework, not CSRF protection

The CSRFProtect class is imported from flask_wtf to enable CSRF protection in Flask apps.

2fill in blank

medium

Complete the code to initialize CSRF protection with the Flask app.

Flask

csrf = CSRFProtect()
app = Flask(__name__)
csrf.[1](app)

Drag options to blanks, or click blank then click option'

Ainit_app

Brun

Cstart

Dcreate

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'run' or 'start' which are not methods of CSRFProtect

Trying to call 'create' which does not exist

The init_app method connects the CSRF protection to the Flask app instance.

3fill in blank

hard

Fix the error in the form class to include CSRF protection.

Flask

class MyForm([1]):
    name = StringField('Name')
    submit = SubmitField('Submit')

Drag options to blanks, or click blank then click option'

ABaseForm

BForm

CFlaskForm

DCSRFProtect

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'Form' which does not include CSRF by default

Using 'CSRFProtect' which is not a form base class

Forms that inherit from FlaskForm automatically include CSRF protection tokens.

4fill in blank

hard

Fill both blanks to create a dictionary comprehension that includes only fields with data and their CSRF token.

Flask

data = {field.name: field.data for field in form if field.[1] and field.name != '[2]'}

Drag options to blanks, or click blank then click option'

Adata

Bcsrf_token

Chas_data

Dis_submitted

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'has_data' which is not a valid attribute

Using 'is_submitted' which is unrelated

Not excluding the 'csrf_token' field

We check field.data to include fields with data and exclude the csrf_token field.

5fill in blank

hard

Fill all three blanks to validate the form and handle CSRF errors in a Flask route.

Flask

from flask_wtf.csrf import [1]

@app.route('/submit', methods=['POST'])
def submit():
    form = MyForm()
    if form.[2]():
        # process form data
        return 'Success'
    else:
        return [3]('CSRF token missing or invalid', 400)

Drag options to blanks, or click blank then click option'

ACSRFError

Bvalidate_on_submit

Cabort

Dcsrf_error

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'csrf_error' which is not a class to import

Using 'validate' instead of 'validate_on_submit'

Returning a string instead of aborting with an error code

CSRFError is imported to handle CSRF exceptions, validate_on_submit() checks form validity including CSRF, and abort sends an HTTP error response.