基於Flask-wtf登錄表單的csrf失敗錯誤

Question

{csrf_token': [u'CSRF failed']} 

在Windows 8上運行的Chrome瀏覽器中顯示錯誤。Firefox不會出現此錯誤。 這是一個燒瓶應用程序，登錄表單使用wtforms進行製作。

<form action="{{url_for('login')}}" name="login" method="post" class="form-horizontal"> 
    {{form.csrf_token}} 
    <h2>{{form_title}}</h2> 
    <hr> 
    <ul><li class="label">{{form.username.label }}</li> 
    <li class="input">{{render_field(form.username)}}</li> 
    <li class="desc">{{form.username.description}}</li> 
    </ul> 
    <ul><li class="label">{{form.password.label }}</li> 
    <li class="input">{{render_field(form.password)}}</li> 
    <li class="desc">{{form.password.description}}</li> 
    </ul> 
    <ul><li class="label">{{form.remember.label }}</li> 
    <li class="input">{{render_field(form.remember)}}</li> 
    <li class="desc">{{form.remember.description}}</li> 
    </ul> 
    <input type="submit" class="sbutton" value="Log In" /> 
</form> 

無法追查其他東西... form.errors的輸出顯示上面的csrf_token錯誤。

巧合的是，當我嘗試登錄使用相同的鉻瀏覽器stackoverflow說第三方cookie被禁用....這可能是上述行爲的原因？任何指針是有益的......

這裏的觀點：

class Login(MethodView): 
def __init__(self): 
    self.form = LoginForm() 

def get(self): 
    return render_template('login.html',form=self.form,form_title="Login User") 

def post(self): 
    username = self.form.username.data 
    password = self.form.password.data 

    log_handle.debug(self.form.data.items()) 
    if self.form.validate_on_submit(): 
     qstr = "SELECT * FROM user_account WHERE email='%s'"%(username) 
     try: 
      cursor.execute(qstr) 
     except Exception: 
      log_handle.exception("Could not execute:%s"%(qstr)) 
      flash("Could not log you on. Consult admin") 
      redirect(url_for("index")) 

     try: 
      a = cursor.fetchall() 
     except Exception: 
      log_handle.exception("Could not fetch of data from:%s"%(qstr)) 
      flash("Could not log you on. Consult admin") 
      redirect(url_for("index")) 


     #now create a object understood by the flask-login 
    #now create a object understood by the flask-login 
     fuser = Login_user(name=a[0]['username'],id=a[0]['id'],active=a[0]['is_active'],user_role=a[0]["role"]) 

     remember = request.form.get("remember", "no") == "yes" 
     if login_user(fuser,remember): 
      session['language'] = app.config['BABEL_DEFAULT_LOCALE'] 
      #set customer type session variables 
      a = SessionVar() 
      a.set_customer_type() 

      flash("Logged in!") 
      return redirect(url_for("campaign_mod")) 
     else: 
      flash("Sorry, but you could not log in.") 
    else: 
     flash("failed csrf token") 
     log_handle.debug(self.form.errors) 
     log_handle.debug(self.form.data.items()) 
     return render_template('403.html'), 403 

和形式：

class LoginForm(Form): 
username = TextField(_(u"Email"),[validators.Required(),validators.Email()],description="use your email as your username") 
password = PasswordField(_(u"password"),[validators.Required()],description="Your password") 
remember = BooleanField(_(u"Remember Me."),default=True, 
            description=_(u"This will store a cookie so as to restore it when you revisit the site.")) 
def validate_password(form,field): 
    #now check if the username and password are correct combination. 
    qstr = "SELECT * FROM user_account WHERE email='%s'"%(form.username.data) 
    cursor.execute(qstr) 
    a = cursor.fetchall() 

    if len(a) > 0: 
     hpasswd = a[0]['password'] 
     if bcrypt.hashpw(form.password.data, hpasswd) != hpasswd: 
      log_handle.debug('password did not match') 
      raise ValidationError('cannot find a valid combination of username/password. Please try again.') 
    else: 
     raise ValidationError('cannot find a valid username. Please try again.') 

Answer 1

嘗試通過{{form.hidden_tag()}}

我的假設代替{{form.csrf_token}}是鉻不發送隱藏標籤的csrf_value。

要檢查這個假設是否正確，您需要在張貼表單後檢查您在flask.request.form [「csrf_token」]處獲得的內容。如果你什麼都得不到，那麼我的假設可能是對的。

至於什麼可能導致它，我知道在XHTML you cannot nest input elements within the form element。這就是爲什麼Flask-WTF有添加隱藏標籤的特殊方式，請參閱this doc page。