Issues

• Bind CSRF tokens to extra data

  pallets-eco/flask-wtf#711 · Filter by author azmeuk opened on Oct 28, 2026

• Error generating tokens on FIPS-enabled systems: Unsupported digestmod <function _lazy_sha1>

  pallets-eco/flask-wtf#699 · Filter by author phinjensen opened on Aug 25, 2026
  2

• Add support for exemption on nested blueprints in CSRFProtect

  pallets-eco/flask-wtf#697 · Filter by author marcsello opened on Aug 15, 2026

• Broken h-captcha (and potentially re-captcha) rendering when combined with Bootstrap-Flask

  pallets-eco/flask-wtf#695 · Filter by author marcsello opened on Aug 15, 2026

• CSRF session token missing when streaming templates

  pallets-eco/flask-wtf#668 · Filter by author lemon24 opened on Mar 8, 2026

• Support for reCAPTCHA v3

  recaptcha
  pallets-eco/flask-wtf#625 · Filter by author bgreenlee opened on Feb 26, 2025

• Docs on alternative Captcha services

  docsrecaptcha
  pallets-eco/flask-wtf#616 · Filter by author loleg opened on Dec 18, 2024

• flask-wtf i18n does not work without flask-babel

  bugi18n
  pallets-eco/flask-wtf#582 · Filter by author azmeuk opened on Oct 3, 2023
  1

• clarification in docs of validate_on_sumbit() and csrf_token

  docs
  pallets-eco/flask-wtf#567 · Filter by author Jeroendevr opened on May 31, 2023

• Setting WTF_CSRF_TIME_LIMIT to "None" is confusing

  csrf
  pallets-eco/flask-wtf#538 · Filter by author malthe opened on Dec 20, 2022

• 'REMEMBER_COOKIE_HTTPONLY' causes "The CSRF tokens do not match" on mobile Firefox

  csrf
  pallets-eco/flask-wtf#521 · Filter by author Lvl4Sword opened on May 23, 2022
  1

• The CSRF session token is missing.

  csrf
  pallets-eco/flask-wtf#519 · Filter by author TomeCirun opened on May 11, 2022
  10

• Allow disabling CSRF based on request context

  csrf
  pallets-eco/flask-wtf#495 · Filter by author hMED22 opened on Dec 22, 2021
  1

• CSRF Token does not attach to session

  csrf
  pallets-eco/flask-wtf#494 · Filter by author Arthurdb1999 opened on Dec 9, 2021
  2

• Allow CSRF to be entirely disabled

  csrfenhancement
  pallets-eco/flask-wtf#483 · Filter by author marksteward opened on Nov 4, 2021

• filename '.ext' seen as a valid file extension

  pallets-eco/flask-wtf#465 · Filter by author jkittner opened on Aug 12, 2021
  2

• OWASP Guidance: prefer Origin header over Referer header when Identifying Source Origin

  pallets-eco/flask-wtf#455 · Filter by author gsmethells opened on Jun 28, 2021
  2

• FileAllowed validator not detecting errors

  pallets-eco/flask-wtf#422 · Filter by author PrinceOsiria opened on Nov 3, 2020

• Integration of LocaleAwareNumberField and DateTimeField with Flask-Babel

  pallets-eco/flask-wtf#398 · Filter by author weinbusch opened on Feb 12, 2020

• Inconsistency with raising CSRFError

  csrfdocsgood first issue
  pallets-eco/flask-wtf#381 · Filter by author pb-jeff-oneill opened on Oct 18, 2019
  2

• Recaptcha validator does not use field data

  recaptcha
  pallets-eco/flask-wtf#370 · Filter by author sr105 opened on Jun 11, 2019
  1

• csrf_token is still needed by FlaskForm if you @csrf.exempt a view

  csrf
  pallets-eco/flask-wtf#361 · Filter by author return1 opened on Feb 28, 2019

• MIME type validation

  pallets-eco/flask-wtf#358 · Filter by author Sohalt opened on Feb 7, 2019

• if recaptcha fail then validate_on_submit is False

  recaptcha
  pallets-eco/flask-wtf#343 · Filter by author r1235613 opened on Jul 25, 2018

• CSRF token: alternatives for the lack of time_limit in v0.14

  csrf
  pallets-eco/flask-wtf#325 · Filter by author riccardolorenzon opened on Feb 6, 2018
  1