0

I am trying to submit a form on a Flask app using curl. Unfortunately, I keep running into the "CSRF token missing" error.

I tried:

curl -X POST --form csrf_token=token --form data=@file.txt --form submit=submit {url} -v

I used a csrf_token from the app while I had it open in a browser. I also looked at https://flask-wtf.readthedocs.org/en/latest/csrf.html and tried to set X-CSRFToken in the header but still got the same error. Any suggestions for what is the correct way to use curl to feed the token to the flask app?

user3487187
  • 89
  • 1
  • 7

1 Answers1

3

The problem is that you just sending token and flask cannot get your session which lives in browser cookie. So if you wish to access your view via curl it's not enough to pass token value within POST request, you have to attach cookie to. You can write cookie to local file with command:

curl -c /path/to/cookiefile {url}

Then modify it and send POST request to your server with attached cookie and token:

curl -b /path/to/cookiefile -X POST --form csrf_token=token --form data=@file.txt --form submit=submit {url} -v
Andriy Ivaneyko
  • 20,639
  • 6
  • 60
  • 82