validate_on_submit and CSRF Tokens
Process valid posts and block forgeries.
validate_on_submit and CSRF Tokens is a free Flask Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Flask Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
The Golden Method
Flask-WTF gives you one method that checks everything at once. validate_on_submit is the heart of safely processing any form. 🔑
What It Actually Checks
validate_on_submit returns True only when the request is a POST and every validator passes. One call covers both conditions.
if form.validate_on_submit():
pass # safe to use the dataThe Standard View Pattern
This shape repeats in every Flask app: build the form, branch on validate_on_submit, then fall through to render the page.
form = LoginForm()
if form.validate_on_submit():
return redirect('/home')
return render_template('login.html', form=form)Submitted vs Valid
Do not confuse the two. is_submitted only checks the method, while validate_on_submit also confirms the data passed every rule.
form.is_submitted() # POST?
form.validate_on_submit() # POST and valid?Why CSRF Matters
A CSRF attack tricks a logged-in user into submitting a form they never meant to. Tokens prove the request came from your own page.
SECRET_KEY Is Required
CSRF tokens are signed, so Flask needs a SECRET_KEY. Without it, validation fails and Flask-WTF refuses to protect the form.
app.config['SECRET_KEY'] = 'change-me-in-production'The Token in the Page
That call to hidden_tag embeds the signed token as a hidden input. The browser sends it back with every submission.
{{ form.hidden_tag() }}Validation Compares Tokens
On submit, Flask-WTF compares the posted token against the session. A missing or stale token makes validate_on_submit return False.
if not form.validate_on_submit():
pass # bad token or failed ruleInspect Why It Failed
When validation fails, look at form.errors. It maps each field name to the list of messages explaining the problem.
if not form.validate_on_submit():
print(form.errors)Process Then Redirect
After a successful submit, finish with a redirect. That follows the PRG pattern and stops a refresh from posting twice.
if form.validate_on_submit():
save(form.data)
return redirect('/done')Never Disable CSRF Blindly
You can turn off CSRF for APIs, but never for browser forms. Keeping protection on is what makes Flask-WTF worth using.
Quick Check
When does form.validate_on_submit() return True?
Recap
You leaned on validate_on_submit for the method-plus-rules check, set a SECRET_KEY for signed CSRF tokens, and redirected after success. 🛡️
Frequently asked questions
Is the “validate_on_submit and CSRF Tokens” lesson free?
Yes — the full text of “validate_on_submit and CSRF Tokens” is free to read here on the web, and the Flask Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Flask Academy course, upgrade to CoddyKit PRO.
What will I learn in “validate_on_submit and CSRF Tokens”?
Process valid posts and block forgeries. You practise Flask Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Flask Academy?
No prior experience is required. Flask Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “validate_on_submit and CSRF Tokens” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Flask Academy lesson?
Yes. Every Flask Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Define a FlaskForm Class
- Render and Submit a Form
- validate_on_submit and CSRF Tokens
- Custom Validators and Field Errors