Closed leoschmitz closed 2 years ago
I've notice that if the application exempts csrf, it also does not update cookies:
https://github.com/maxcountryman/flask-seasurf/blob/4dd3ee016c15c44bec9d12205d2c3d35ca43d997/flask_seasurf.py#L350
Django seems to solve it with this approach: https://docs.djangoproject.com/en/3.2/ref/csrf/#unprotected-view-needs-the-csrf-token
Would this be a valid solution/architecture for you?
Thanks for opening this: I would be happy to merge a PR that follows the Django approach.
I've notice that if the application exempts csrf, it also does not update cookies:
https://github.com/maxcountryman/flask-seasurf/blob/4dd3ee016c15c44bec9d12205d2c3d35ca43d997/flask_seasurf.py#L350
Django seems to solve it with this approach: https://docs.djangoproject.com/en/3.2/ref/csrf/#unprotected-view-needs-the-csrf-token
Would this be a valid solution/architecture for you?