Flask JWT Extended set cookie error

Author of Flask-JWT-Extended here. As you have discovered, with this extension we are currently doing CSRF protection for every type of request. However, CSRF protection is only really needed on state changing requests: See: https://security.stackexchange.com/questions/115794/should-i-use-csrf-protection-for-get-requests/115800

The benefit of protecting all requests types is that if you have an endpoint that incorrectly changes state in a GET request (there is no technical reason this couldn't happen), it becomes vulnerable to CSRF attacks. Now if the backend is designed more 'up to spec', this is no longer a problem. It sounds like I need to update Flask-JWT-Extended to allow for ignoring CSRF protection on certain types of requests, just like how Flask-WTF operates. I'll try to get this updated today.

Alternately, if your backend is serving JSON instead of html directly (such as a REST api backend and javascript frontend), you can use Ajax to do GET requests with CSRF tokens. In this use case, we could use an Ajax call along these lines.

   get (options) {     let self = this     $.ajax({       method: 'GET',       dataType: 'json',       headers: {         'X-CSRF-TOKEN': Cookies.get('csrf_access_token')       },       url: "some_url",       success (result, statusText) {         // Handle success       },       error (jqXHR, textStatus, errorThrown) {         //handle error       }     })   }

EDIT: I also want to preserve the CSRF error messages if the CSRF token isn't present and you are using both headers and cookies for JWTs. Progress on both of these can be tracked here:

• https://github.com/vimalloc/flask-jwt-extended/issues/28
• https://github.com/vimalloc/flask-jwt-extended/issues/29