python - Flask-wtf: csrf_token is removed from session before I can POST my form -

i'm using flask flask-security (specifically flask-wtf regarding csrf issue) "ease" process of register/loggin users (not easy far). i'm using backbonejs on front-end, therefore kind of hacked original way use flask-wtf. indeed, make ajax request on /register register page (generated flask-security) , put resulting html in modal.

render: function () {             var self = this;             $.ajax({                 type: 'get',                 url: config.constants.servergateway + "/register"             }).done(function(result){                 console.log("get register done", result);                 var html = self.template({ config: config, form: result });                 self.$el.html(html);             }).fail(function(error){                 console.log("could not register token", error);                 var html = this.errortemplate({ config: config });                 self.$el.html(html);             });              return this;         } 

this way have generated csrf, , when post registration data, send right csrf along user data (email , password).

submit: function () {             console.log("submit");             var self = this;             var formdata = this.$el.find('form').serialize();             $.ajax({                 type: 'post',                 url: config.constants.servergateway + "/register",                 data: formdata,                 datatype: 'json'             }).done(function(result){                 self.trigger('close');             }).fail(function(error){                 console.log("could not submit register data", error);             });         } 

on server-side, can debug python code see csrf_token has been generated when requested register page has disappeared session object, therefore leading generation of new one, of course didn't match 1 send form. session still same though, _id same during , post.

you can see code in flask_wtf/csrf.py::generate_csrf(), called when creating form object in ::register function flask_security/views.py

if 'csrf_token' not in session:     session['csrf_token'] = hashlib.sha1(os.urandom(64)).hexdigest() 

it results in csrf token missing error.

an additionnal information, front-end , back-end delivered same server, have different port number.

last, when use href on front-end , display page returned server on 'get' request, submitting form works well. liked display registration form in modal.

thanks help

okay, figured out solution problem. feel noob (which am).

the problem lied in session credentials not sent server requests, server coudldn't access session cookie. found solution in following tutorial: http://backbonetutorials.com/cross-domain-sessions/ send it, added following lines in backbone router initialize function:

// use withcredentials send server cookies // server must allow through response headers $.ajaxprefilter( function( options, originaloptions, jqxhr ) {     options.xhrfields = {         withcredentials: true     }; }); 

this makes ajax requests include withcredentials = true. on server-side, had set access-control-allow-credentials:true. since i'm using flask-cors, done [supports_credentials=true][2] when creating cors object.