[Python] jwt-extended and post form issue

I have a flask app with jwt_extended config as auth. For all pages, it works without any issue. But for pages with a form and post methods, when I submit the form, the app redirect me to the login page in loop ( even if I log or already loggued ).

If I put : JWT_COOKIE_CSRF_PROTECT = False I don't have any issue

search/search.html

{% extends "base.html" %}

{% block content %}

<nav class="uploadbar">
<form id="form-navbar" method="POST" action="/search/" class="form-inline formupload" enctype="multipart/form-data">
<input id="host-navbar-upload" class="form-control mr-sm-2" name="hostname-list" type="file" accept=".csv" placeholder="Upload a csv file..." aria-label="Upload">
<button id="upload-navbar" class="btn btn-primary my-2 my-sm-0 button-form-upload" type="submit">Upload</button>
</form>
</nav>

{% endblock %}


auth/routes.py

from app.auth import bp
from flask import current_app

from app.extensions import ldap

from flask import (
g,
render_template,
request,
session,
redirect,
url_for,
jsonify,
make_response,
flash
)

from flask_jwt_extended import (
create_access_token,
create_refresh_token,
set_access_cookies,
set_refresh_cookies,
unset_jwt_cookies,
get_jwt_identity
)

from flask_jwt_extended import jwt_required

@bp.route('/')
@jwt_required()
def index():
return jsonify('Login Successfull')

@bp.route("/login/", methods=["GET","POST"])
def login():
if g.user:
return redirect(url_for("dashboard.dashboard"))

if request.method == "POST":
user = request.form["username"]
passwd = request.form["password"]
test = ldap.bind_user(user, passwd)

if test is None or passwd == "":
flash('Invalid username or password. Please try again.', 'danger')
current_app.logger.info('Invalid password for user : %s', user)

else:
access_token = create_access_token(identity=user)
refresh_token = create_refresh_token(identity=user)
response = make_response(redirect(url_for('dashboard.dashboard')))
set_access_cookies(response, access_token)
set_refresh_cookies(response, refresh_token)

return response

return render_template('auth/login.html',title='Login')

@bp.route("/token/refresh", methods=["POST"])
@jwt_required(refresh=True)
def refresh():
identity = get_jwt_identity()
access_token = create_access_token(identity=identity)

return jsonify(access_token=access_token)

@bp.route("/logout/")
@jwt_required()
def logout():
response = make_response(redirect(url_for("auth.login")))
unset_jwt_cookies(response)

return response


search/routes.py

from app.search import bp
from flask import render_template
from flask import request
from app.extensions import db, ldap
from flask import current_app as app
from flask_jwt_extended import jwt_required
import pandas as pd
from app.utils import df_parser

@bp.route('/', methods=["GET", "POST"])
@jwt_required()
def search():

host = 'vautour2'

if request.method == "POST":
df = pd.read_csv(request.files.get('hostname-list'))
df = df_parser(df)
hostlist = df['name'].tolist()

print(hostlist)

return render_template('search/search.html',title='Search',
host=host,
)

@bp.route('/result/', methods=["GET", "POST"])
@jwt_required()
def result():

if request.method == "POST":
host = request.form["hostname"]

return render_template('search/result.html',title='Search result',
host=host,
)


Any idea ?

Continue reading...