Closed wwwillchen closed 2 weeks ago
Implementation:
Notes:
from flask import Flask, session
app = Flask(__name__)
app.secret_key = 'your-secret-key' # Use tink? Or does this need to be same across apps?
@app.before_request
def set_csrf_token():
if 'csrf_token' not in session:
session['csrf_token'] = generate_csrf_token()
Right now, the origin check seems to be adequate as it hasn't caused any issues after the initial implementation PRs. Doing CSRF tokens could cause some usability issues as the tokens could expire in the middle of a Mesop user session which would be a bad user experience. Closing this as done.
References:
Considerations:
secure
andhttponly