Flask:CSRF验证失败

Question

我正在从iOS客户端发送POST请求

-(void)loadFavorite:(NSArray*)favorites{

    //data and url preparation

    NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:url
                                                       cachePolicy:NSURLRequestUseProtocolCachePolicy timeoutInterval:60.0];
    [request setHTTPMethod:@"POST"];
    [request setValue:@"application/json" forHTTPHeaderField:@"Accept"];
    [request setValue:@"application/json" forHTTPHeaderField:@"Content-Type"];
    [request setValue:@"https://example.com" forHTTPHeaderField: @"Referer"];

    [request setValue:[NSString stringWithFormat:@"%tu", [requestData length]] forHTTPHeaderField:@"Content-Length"];
    [request setHTTPBody: requestData];

    if ([Tools isNetWorkConnectionAvailable]) {
        [NSURLConnection sendAsynchronousRequest:request queue:[NSOperationQueue mainQueue] completionHandler:^(NSURLResponse *response, NSData *data, NSError *error) {
            //response handle
    }
}

以下是回复:

<div id="summary">
  <h1>Forbidden <span>(403)</span></h1>
  <p>CSRF verification failed. Request aborted.</p>
</div>

我正在使用Flask框架和pythonanywhere进行托管.

当我重新加载python脚本时它工作正常,但几小时/几天后CSRF验证失败错误重新出现.

即使我尝试在app.py中禁用CSRF验证:

app.config['WTF_CSRF_CHECK_DEFAULT'] = False

App.py脚本:

//some import error handlers ...

app = Flask(__name__)
app.config['WTF_CSRF_CHECK_DEFAULT'] = False

@app.route('/api/favorites', methods=['POST'])
def get_favorites_beaches():
    if not request.json or not 'favorite' in request.json:
        abort(400)
    //data process

if __name__ == '__main__':
    app.run(host='0.0.0.0',debug=True)

如何正确实施CSRF验证或如何禁用它？

Answer 1

你的代码中有一行是[request setValue:@"https://example.com" forHTTPHeaderField: @"Referer"];

你没有设置正确的url吗？错误的引用者是导致跨站点错误的一种原因。

康拉德