Disable CSRF check for requests without cookies

[Virusmater]

My Flask app has mix of regular routes that supposed to be used by end users and routes for REST API exposure.
I want to protect regular routes with CSRF (will be used by users with cookies), but don't need it for APIs (it will have header authentication)

Is there any way to disable CSRF check in Flask-WTF for requests that have no cookies set at all?

[davidism]

Use the Meta object or options to control things such as CSRF: https://wtforms.readthedocs.io/en/2.3.x/meta/

For example, if your API is under the api blueprint:

from flask_wtf import FlaskForm

class APIForm(FlaskForm):
    class Meta:
        @property
        def csrf(self):
            return request.blueprint == "api"

Or another check, depending on your requirements.

[Virusmater]

But then api blueprint will have no CSRF protection at all and those routes would be possible to attack using CSRF if user will have cookies.

[davidism]

OK, then make the check more complex. Only you know the requirements you need for your specific API, the concept remains the same no matter what those requirements are. I think you're misunderstanding CSRF.