Registry / web-framework / flask-seasurf

flask-seasurf

library2.0.0pypypi✓ verified 85d ago

Flask-SeaSurf is an updated CSRF protection extension for Flask applications. It provides cross-site request forgery prevention via tokens, with support for AJAX requests, cookie-based tokens, and exclusion patterns. Version 2.0.0 is the latest release, with maintenance as needed.

web-framework auth-security

pip install flask-seasurf

github ↗package ↗

INSTALL

IMPORT

SIG · FLASK-SEASURF

flask-seasurf

web-frameworkpythonv2.0.0

Install

2.2s avg

Import

469ms

Disk

21MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v2.0.0 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.484s · 22.5MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 2.2s · import 0.454s · 23MB

21MB installed

● package 21MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

SeaSurf

✓ from flask_seasurf import SeaSurf

✗ from flask.ext.seasurf import SeaSurf

Flask extensions were renamed; flask.ext.* is deprecated since Flask 0.12 and removed in Flask 2.0.

Initialize SeaSurf with the Flask app and include {{ csrf_token() }} in forms.

from flask import Flask from flask_seasurf import SeaSurf app = Flask(__name__) app.secret_key = 'your-secret-key' csrf = SeaSurf(app) @app.route('/') def index(): return '''<form action="/submit" method="post"> <input type="hidden" name="_csrf_token" value="{{ csrf_token() }}"> <input type="submit"> </form>''' @app.route('/submit', methods=['POST']) def submit(): return 'OK' if __name__ == '__main__': app.run()

Debug

Known issues

breakingIn version 2.0.0, the CSRF token is no longer automatically injected into responses. You must manually include {{ csrf_token() }} in your templates or use the `add_csrf_token` decorator.

fix

Update templates to render csrf_token() or decorate routes with @csrf.add_csrf_token.

affects: >=2.0.0

breakingFlask-SeaSurf 2.0.0 changed the default token cookie name from 'csrf_token' to '_csrf_token' to avoid conflicts with other frameworks.

fix

Update any client-side code that reads the cookie, or configure the cookie name via CSRF_COOKIE_NAME.

affects: >=2.0.0

gotchaSeaSurf requires `SECRET_KEY` to be set on the app, otherwise it raises a RuntimeError on initialization.

fix

Set app.secret_key or SECRET_KEY config before initializing SeaSurf.

affects: all

gotchaWhen using AJAX, the token must be sent via the X-CSRFToken header (or configured header). SeaSurf does not check POST body tokens by default for AJAX requests.

fix

Include the token in a header like X-CSRFToken with the same value as the cookie or template token.

affects: all

Errors

Common errors & fixes

ImportError: cannot import name 'SeaSurf' from 'flask.ext.seasurf'

Using the deprecated flask.ext.seasurf namespace, removed in Flask 2.0.

fix

Change import to 'from flask_seasurf import SeaSurf'.

RuntimeError: A secret key is required to use CSRF.

Flask app does not have SECRET_KEY configured.

fix

Add 'app.secret_key = "your-secret-key"' before initializing SeaSurf.

Upgrade

Version history

2.0.0latest on PyPI · released Jul 29, 2024

Audit

Dependencies

No dependency data recorded yet.

Agent activity

26 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/maxcountryman/flask-seasurf ↗

packagehttps://pypi.org/project/flask-seasurf/ ↗