Flask报错CSRF token is missing，Flask-RESTful禁用CSRF无效求助

Hey there, let's work through your Flask CSRF issues step by step—this is a super common gotcha when mixing Flask-WTF's CSRF protection with Flask-RESTful, so I’ve got a few actionable fixes that should sort this out.

First: Fix the "CSRF token is missing" Error for Regular Requests #

Before diving into disabling CSRF for specific endpoints, let's make sure your base CSRF setup is solid:

• Ensure you're rendering the token in forms: For regular HTML form POST requests, add the hidden CSRF field in your template:

  <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
  

• AJAX/JSON requests need header support: If you're sending POST requests via JS, grab the CSRF token from the csrf_token cookie (Flask-WTF sets this by default) and include it in your request headers as X-CSRFToken.
• Double-check your SECRET_KEY: Flask-WTF's CSRF system relies on this to generate tokens—make sure it's set in your app config (e.g., app.config['SECRET_KEY'] = 'your-secret-here').
• Initialize CSRFProtect correctly: Use either csrf = CSRFProtect(app) or delayed initialization with csrf = CSRFProtect() followed by csrf.init_app(app) later.

Disabling CSRF for Specific Flask-RESTful POST Endpoints (The Tricky Part) #

The main issue here is that Flask-RESTful's Resource classes don't play nice with Flask-WTF's @csrf.exempt decorator out of the box—decorating the post() method directly won't work because it's not the actual view function Flask uses. Here are three reliable ways to fix this:

Method 1: Exempt the Entire Resource Class #

If every method in your RESTful resource doesn't need CSRF protection, decorate the entire class with @csrf.exempt:

from flask_wtf.csrf import CSRFProtect, csrf
from flask_restful import Api, Resource

# Initialize your app, CSRF, and API first
csrf = CSRFProtect(app)
api = Api(app)

@csrf.exempt
class UnprotectedResource(Resource):
    def post(self):
        # Your POST logic here (no CSRF check)
        return {"status": "success", "message": "POST processed without CSRF"}
    
    def get(self):
        # This method is also exempt, adjust if needed
        return {"data": "some public data"}

api.add_resource(UnprotectedResource, "/api/unprotected-endpoint")

Method 2: Exempt Only the POST Method #

If you want to keep CSRF protection for other methods (like GET/PUT) but skip it for POST, override the resource's dispatch_request method to conditionally exempt the POST request:

from flask import request

class SemiProtectedResource(Resource):
    def dispatch_request(self, *args, **kwargs):
        # Skip CSRF check only for POST requests
        if request.method == 'POST':
            return csrf.exempt(super().dispatch_request)(*args, **kwargs)
        # All other methods use default CSRF protection
        return super().dispatch_request(*args, **kwargs)
    
    def post(self):
        return {"status": "success", "message": "POST is exempt"}
    
    def get(self):
        # This GET request still requires CSRF if your global setup enforces it
        return {"data": "protected data"}

api.add_resource(SemiProtectedResource, "/api/semi-protected")

Method 3: Flip the Default (Exempt All, Protect Only What You Need) #

If most of your RESTful endpoints don't need CSRF (common for APIs that use token-based auth instead), change the default behavior so CSRF is only applied to specific views:

# Disable default CSRF checking for all requests
app.config['WTF_CSRF_CHECK_DEFAULT'] = False
csrf = CSRFProtect(app)

# Only apply CSRF to the views that need it (e.g., regular form-based routes)
@app.route('/submit-form', methods=['POST'])
@csrf.protect
def submit_form():
    # Handle form submission with CSRF protection
    return "Form submitted safely"

# Flask-RESTful resources are automatically exempt by default
class APIResource(Resource):
    def post(self):
        # No CSRF check needed here
        return {"status": "success"}

api.add_resource(APIResource, "/api/submit-data")

Common Pitfalls to Verify #

• No duplicate CSRF initializations: If you're initializing CSRFProtect in multiple files (e.g., app setup and a blueprint), this can override your exemptions—stick to one initialization.
• Check for route conflicts: Make sure your Flask-RESTful endpoint isn't being overridden by a regular Flask route that still has CSRF protection enabled.
• Blueprint compatibility: If using blueprints, initialize CSRFProtect on the blueprint (csrf.init_app(blueprint)) and apply exemptions to blueprint-specific resources.

内容的提问来源于stack exchange，提问作者Francisco