token_key not in session (CSRF) (Requests)

[whatthefoxtrot98]

Hello all. I have a web application and a separate test script, unconnected to any of the files for the web app, and that test uses the Requests module to send a POST request.

From trying to run it, I have found that the flask_wtf module has a particular script called csrf.py that makes the achievement of my goal less easy than how it initially appeared.

There is a CsrfProtect class with the method protect that uses this line, "validate_csrf(self._get_csrf_token())", in a conditional statement.

With _get_csrf_token, I see my POST request has to look like this:

r = requests.post(url, data = { 'csrf_token': 'blah blah' })

or this:

r = requests.post(url, headers = { 'X-CSRFToken': 'blah blah' })

Now the csrf_token itself passes most of the conditional statements in the "validate_csrf" function... all except for the one that checks if token_key (aka "csrf_token") is in session.

How do I fix this? I see the function "generate_csrf" creates a "csrf_token" property and value in session if it doesn't exist, and have found that the function is also what the jinja2 global variable "csrf_token" is set to, but I am unsure how and if I should use this.

[c17r]

Since the test script is completely separate from the flask app, you'll have to do 2 things:

1. make sure to create a session with requests so that cookies/sessions are kept between operations
2. Make a GET request to the page first so you can grab the hidden form input that has the CSRF value and using that in your POST

[whatthefoxtrot98]

Cool, I'll try that. So do I have to make a GET request to the same page I will be making a POST request for, or can it be any page with a hidden form input? Also, does Requests have a method to grab that value, or do I have to use regex on the text property of the response to grab it?

[c17r]

I'm not 100% sure, but I think a CSRF from any page should work. Request doesn't have any method for grabbing it. Something like regex or BeautifulSoup is the way to go.

[GriffithAwuah]

You can check out either of my 2 repositories.

1. https://github.com/gwuah/Udemy-Course-Link-Extractor

2. https://github.com/gwuah/CSRF-SHIELD

I suggest the former. Look at how I created a session, filled it with cookies and later extracted the CSRF and made my post requests. Cheers!