Flask-Restful POST fails due CSRF protection of Flask-WTF
More simple solution (related commit):
csrf.exempt(api_blueprint)
And here is a complete demo:
from flask import Flask, Blueprint
from flask_wtf import CSRFProtect
app = Flask(__name__)
csrf = CSRFprotect(app)
api_blueprint = Blueprint('api', __name__)
csrf.exempt(api_blueprint)
app.register_blueprint(api_blueprint)
You can use the @csrf.exempt
decorator, which you need to add directly on the API object, with the decorators
argument; this would apply the decorator to all API routes:
csrf_protect = CsrfProtect(app)
api = restful.Api(app, decorators=[csrf_protect.exempt])
You cannot use resource method decorators as they are not the final view functions that the exempt
decorator requires to work.
It appears you cannot protect individual resources and exempt others; this is a limitation in the method used by Flask-Wtf's method of recording what views are exempted.