maxcountryman / flask-seasurf

SeaSurf is a Flask extension for preventing cross-site request forgery (CSRF).
http://readthedocs.org/docs/flask-seasurf/
Other
190 stars 49 forks source link

Adding CSRF token to unprotected view. #102

Closed leoschmitz closed 2 years ago

leoschmitz commented 3 years ago

I've notice that if the application exempts csrf, it also does not update cookies:

https://github.com/maxcountryman/flask-seasurf/blob/4dd3ee016c15c44bec9d12205d2c3d35ca43d997/flask_seasurf.py#L350

Django seems to solve it with this approach: https://docs.djangoproject.com/en/3.2/ref/csrf/#unprotected-view-needs-the-csrf-token

Would this be a valid solution/architecture for you?

maxcountryman commented 3 years ago

Thanks for opening this: I would be happy to merge a PR that follows the Django approach.