The CSRF token is missing - Flask WTForms Python

Question

I'm trying to create a Login form in Flask. But, every time I fill in the information and click "Log In", it gives me an error: 'csrf_token': ['The CSRF token is missing.']}

When I check the webpage code in my browser, it shows that I do have a CSRF token in the form.

<h1>Log In</h1>
<form action="/" method="POST" class="register">
    <input id="csrf_token" name="csrf_token" type="hidden" value="IjAyZjNmOGZmMmRhNGIyOWI1YTBiNmVhMzNiYTU3MGUxY2U2ZTAxZmQi.X5V_4A.5EzKomC48Xa0I3iNinFu1yncRak">
    <input id="csrf_token" name="csrf_token" type="hidden" value="IjAyZjNmOGZmMmRhNGIyOWI1YTBiNmVhMzNiYTU3MGUxY2U2ZTAxZmQi.X5V_4A.5EzKomC48Xa0I3iNinFu1yncRak">

    <div class="username">
        <label for="username">Username</label>
        <input id="username" name="username" placeholder="8 to 20 characters" required type="text" value="">
    </div>

This is my form:

class LoginForm(FlaskForm):
    username = StringField('Username', validators=[DataRequired(), Length(min=8, max=20)], 
        render_kw={'placeholder': '8 to 20 characters'})
    password = PasswordField('Password', validators=[DataRequired(), Length(min=8)])

    remember_me = BooleanField('Remember Me')
    submit = SubmitField('Log In')

And this is the route:

@users.route('/login', methods=['GET', 'POST'])
def login():
    form = LoginForm()
    if form.validate_on_submit():
        from app.users.models import User
        print('validate on submit')

        user = User.query.filter_by(username=form.username.data).first()
        flash(user)
        print(user)

        if user is None:
            flash('Invalid username or password', 'error')
            return redirect(url_for('login'))

        if user is not user.check_password(form.password.data):
            flash('Invalid username or password', 'error')
            return redirect(url_for('login'))
            
        login_user(user, remember=form.remember_me.data)

        next_page = request.args.get('next')
        if not next_page or url_parse(next_page).netloc != '':
            next_page = url_for('home')
        return redirect(next_page)
    print(form.errors)
    
    return render_template('users/login.html', title='Log In', form=form)

I have a config class that does create a secret key, as well:

class Config:
    app.config['SECRET_KEY'] = 'era14149dfafjf328491rej1f19914'

The form also contains a hidden_tag and a csrf_token :

<h1>Log In</h1>
<form action="/" method="POST" class="register">
    {{ form.hidden_tag() }}
    {{ form.csrf_token }}

What am I doing wrong? The form is showing a CSRF token in the webpage code but for some reason, it still doesn't work...

Well in both cases of you giving your form, you never actually close (</form>) the tag — roganjosh
– roganjosh, Commented Oct 25, 2020 at 13:52
@roganjosh I am closing the </form> tag. That wasn't the full form code. This is the full code: pastebin.com/h2C7whdh — fecigo
– fecigo, Commented Oct 25, 2020 at 14:38

Andrew Clark · Accepted Answer · 2020-10-29 17:06:22Z

4

Try changing your html code to the following:

<h1>Log In</h1>
<form action="/" method="POST" class="register">
    {{ form.csrf_token }}

From my experience, you do not need form.hidden_tag() Documentation here

If my answer helped you, please consider upvoting my post. I'm new on this site and trying to earn enough reputation to be able to comment on post :) Thank you! Happy Coding

answered Oct 29, 2020 at 17:06

Andrew Clark

8807 silver badges13 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

fecigo Over a year ago

Thanks for the answer! It doesn't seem to have helped, though. I still get the same error. :(

Andrew Clark Over a year ago

Did you ever find what was wrong with your code here?

Collectives™ on Stack Overflow

The CSRF token is missing - Flask WTForms Python

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related