maxcountryman / flask-seasurf

SeaSurf is a Flask extension for preventing cross-site request forgery (CSRF).
http://readthedocs.org/docs/flask-seasurf/
Other
190 stars 49 forks source link

Traceback on any route #43

Closed shuhaowu closed 10 years ago

shuhaowu commented 10 years ago

I cannot reproduce this one reliably as it only seems to happen on my production box.

Here's the traceback:

Traceback (most recent call last):
File "/home/projecto/venv/lib/python2.7/site-packages/flask/app.py", line 1836, in __call__
  return self.wsgi_app(environ, start_response)
File "/home/projecto/venv/lib/python2.7/site-packages/flask/app.py", line 1820, in wsgi_app
  response = self.make_response(self.handle_exception(e))
File "/home/projecto/venv/lib/python2.7/site-packages/flask/app.py", line 1403, in handle_exception
  reraise(exc_type, exc_value, tb)
File "/home/projecto/venv/lib/python2.7/site-packages/flask/app.py", line 1817, in wsgi_app
  response = self.full_dispatch_request()
File "/home/projecto/venv/lib/python2.7/site-packages/flask/app.py", line 1477, in full_dispatch_request
  rv = self.handle_user_exception(e)
File "/home/projecto/venv/lib/python2.7/site-packages/flask/app.py", line 1381, in handle_user_exception
  reraise(exc_type, exc_value, tb)
File "/home/projecto/venv/lib/python2.7/site-packages/flask/app.py", line 1473, in full_dispatch_request
  rv = self.preprocess_request()
File "/home/projecto/venv/lib/python2.7/site-packages/flask/app.py", line 1666, in preprocess_request
  rv = func()
File "/home/projecto/venv/lib/python2.7/site-packages/flask_seasurf.py", line 251, in _before_request
  if some_none or not safe_str_cmp(request_csrf_token, csrf_token):
File "/home/projecto/venv/lib/python2.7/site-packages/werkzeug/security.py", line 117, in safe_str_cmp
  return _builtin_safe_str_cmp(a, b)
TypeError: 'unicode' does not have the buffer interface
shuhaowu commented 10 years ago

It looks like request_csrf_token is an unicode and csrf_token is a string. If both of them are the same type then it works.

shuhaowu commented 10 years ago

Nope. https://github.com/mitsuhiko/werkzeug/issues/537