Flask-Restful POST fails due CSRF protection of Flask-WTF
flask, flask-restful, flask-wtforms, python, rest
Solution
You can use the `@csrf.exempt` decorator, which you need to add directly on the API object, with the `decorators` argument; this would apply the decorator to all API routes:
csrf_protect = CsrfProtect(app)
api = restful.Api(app, decorators=[csrf_protect.exempt])
You cannot use resource method decorators as they are not the final view functions that the `exempt` decorator requires to work.
It appears you cannot protect individual resources and exempt others; this is a limitation in the method used by Flask-Wtf's method of recording what views are exempted.
Problem
I am using normal flask web + flask-restful. So I need CSRF protection for web but not for REST. The moment I enable `CsrfProtect(app)` of `flask-wtf`, all my post unit tests for `flask-restful` return a 400. Is there a way to disable CSRF protection for REST services since they are coming from mobile handsets without session handling anyway, hence CSRF wouldn't make much sense. This is how I test it: ``` rv = self.client.post('api/v1.0/verify-email', environ_base={'REMOTE_ADDR': '127.0.0.1'}, headers={'Content-Type':'application/json'}, data=json.dumps(data)) self.check_content_type(rv.headers) eq_(rv.status_code, 412) ```