Wsrtjtyk

For my login page, I have enable a captcha where user has to enter a 4 digits as displayed in the image. I'm using flask-session-captcha module for this. I followed exactly the same steps as in the instruction.

In the same login page, I also have a hidden CSRF token.

<input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>

It's working fine when I developed and tested it in my local environment (my laptop) but it doesn't work when I tested it in the test server. It will give errors such as "The CSRF tokens do not match." or "Invalid captcha" (even though I answered correctly) or sometimes "Missing CSRF token".

I have tried so many things like using decorator @csrf_exempt for that particular login page. I also added this:

@app.after_request

def apply_caching(response):

    response.headers["X-Frame-Options"] = "SAMEORIGIN"

    response.headers["Cache-Control"] = "public, max-age=0, no-cache, no-store, must-revalidate"

    response.headers["Pragma"] = "no-cache"

    response.headers["Expires"] = "0"

    return response

But nothing seems to work. It really puzzles me why it works on local but not on test server. I tried not to use csrf_token() in the login page but it gave me error of missing csrf token. Using Google ReCaptcha is not an option because the user doesn't want to use that.

I wonder if it's because the captcha token is conflicted with the csrf token?

Can you try flask_recaptcha?

Below are minimized example.

#app/__init__.py

from flask_recaptcha import ReCaptcha

recaptcha = ReCaptcha(app=app)



#app/views/your_view.py

@app.route('/a_view_for_demo/', methods=['GET', 'POST'])

def a_view_for_demo():

    a_form = AForm()

    if a_form.validate_on_submit() and recaptcha.verify():

        # do your thing after validation.



    return render_template('a_template.html', a_form=a_form)



#app_config

RECAPTCHA_ENABLED=True

RECAPTCHA_SITE_KEY="get this key from Google"

RECAPTCHA_SECRET_KEY="get this key from Google"



# a_template.html



<form .....>

   {{ a_form.csrf_token }}

   {{ recaptcha }}

</form>