Update example webserver_config.py to show correct CSRF config #8944
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
CSRF_ENABLED does nothing. Thankfully, due to sensible defaults in flask-wtf, CSRF is on by default, but we should set this correctly. Fixes apache#8915
ashb
commented
May 21, 2020
| @@ -34,7 +34,7 @@ | |||
| SQLALCHEMY_DATABASE_URI = conf.get('core', 'SQL_ALCHEMY_CONN') | |||
|
|
|||
| # Flask-WTF flag for CSRF | |||
| CSRF_ENABLED = True | |||
| WTF_CSRF_ENABLED = True | |||
There was a problem hiding this comment.
https://github.com/lepture/flask-wtf/blob/v0.14.2/flask_wtf/csrf.py#L176-L189 is what reads this. I have confirmed that setting CSRF_ENABLE=False does nothing, but setting WTF_CSRF_ENABLED = False does correctly disable the requirement for CSRF.
mik-laj
approved these changes
May 21, 2020
kaxil
pushed a commit
that referenced
this pull request
Jun 22, 2020
potiuk
pushed a commit
that referenced
this pull request
Jun 29, 2020
kaxil
pushed a commit
that referenced
this pull request
Jul 1, 2020
cfei18
pushed a commit
to cfei18/incubator-airflow
that referenced
this pull request
Mar 5, 2021
…e#8944) CSRF_ENABLED does nothing. Thankfully, due to sensible defaults in flask-wtf, CSRF is on by default, but we should set this correctly. Fixes apache#8915 (cherry picked from commit 16206cd)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
CSRF_ENABLED does nothing.
Thankfully, due to sensible defaults in flask-wtf, CSRF is on by
default, but we should set this correctly.
Fixes #8915
Make sure to mark the boxes below before creating PR: [x]
In case of fundamental code change, Airflow Improvement Proposal (AIP) is needed.
In case of a new dependency, check compliance with the ASF 3rd Party License Policy.
In case of backwards incompatible changes please leave a note in UPDATING.md.
Read the Pull Request Guidelines for more information.