Hacker News Reader

Most people who use Flask are also using Flask-WTF for their forms, and the default "FlaskForm" object exposed by it uses CSRF tokens by default.

View on HN

Last month flask has been downloaded 45 177 334 times, flask-wtf 3 466 675 times. That's 7%.

1. Not all servers serve web pages. As for how big percentage of Flask users thus don’t need CSRF is hard to guess

2. WTForms is not the only way to do CSRF tokens with Flask

My point is that it’s not plausible to infer with certainty that some large part of Flask users would not have CSRF tokens just because Flask has more downloads than Flask-WTF

Just anecdata but me (and my team back then) used Flask for years, I'm pretty sure zero of our apps even had a form for users to interact with. It used to be very popular for REST APIs.

Indeed, you can also create a Jinja macro to auto-insert the token into all of your forms too, here's a code example[0]. It's a 100% solved problem both on the Flask back-end and template side with an ability to opt out of it when you need to on the back-end such as when accepting webhooks from another service.

[0]: https://github.com/nickjj/build-a-saas-app-with-flask/blob/1...

Reply on news.ycombinator.com