csrf.error_handler does not work as documented

[wobsta]

When I set an csrf.error_handler function as documented, the csrf errors actually are silenced! Let me show you this in a very minimal example. Lets start with a minimal working example (without own error_handler):

from flask import Flask
from flask.ext.wtf.csrf import CsrfProtect

app = Flask(__name__)
app.config['SECRET_KEY'] = 'spam'
csrf = CsrfProtect(app)

@app.route('/', methods=['GET', 'POST'])
def profile():
    return '<form method=POST action="/"><input type=submit>'

app.run()

When you submit the form, it fails due to the missing csrf token. Similarly it would fail when this token is included, but cookies are disabled in the browser, and thus the token is not available in the session. (In my use-case I want to have a proper error message explaining this problem, but this is not important for showing the issue.)

If I now follow the documentation and add a personal csrf error_handler I would add:

@csrf.error_handler
def csrf_error(reason):
    return 'my error message'

Unfortunately this would silence the error completely! While this function will be called, it will not be transformed into an HTTPException. I came up with a working solution (without patching flask_wtf) by:

@csrf.error_handler
def csrf_error(reason):
    from flask import abort
    from werkzeug.wrappers import Response
    abort(Response('my error message', status=400, content_type='text/html'))

While this works for me at the moment, the issue should probably be corrected within flask_wtf.

[Off-IT]

I changed the last line of the _csrf_protect function from self.protect() to return self.protect() and it works. Looks like a bug in v0.12

[lepture]

@Off-IT could you send me a pull request with your fix?

[docapotamus]

@lepture I can understand why the PR was closed here but it still doesn't stop the documentation being misleading.

http://flask-wtf.readthedocs.org/en/latest/csrf.html

It looks that returning a render_template should do the trick for errors. This would be in-keeping with Flask error handlers.

If you can decide which way round it should be (the abort fix works fine above for what I needed) I would be more than happy to update the docs for you.

[davidism]

#264 deprecated error_handler. Use Flask's error handling system with @app.errorhandler(CsrfError). As a temporary measure, custom handlers decorated with @csrf.error_handler allow both return and raise.