title: CSRF protection with a React Form, a Flask server, and Flask-WTF
body: <p>TL;DR I need to protect my form from CSRF attacks and I want to use ReactJS for the frontend and Flask/Flask-WTF for the backend.</p>
  
  <p>I’m refactoring a website built with Python, Flask, and Flask-WTF for forms and I want to use React for the frontend rather than Jinja2 through PyPugjs. I’m using Flask-WTF to render the forms and it takes care of the CSRF tokens and such. I know how to make a form with React but how do I get CSRF protection?</p>
  
  <p>Right now my form rendering looks like this: (uses Pug)</p>
  
  <pre><code>mixin render_form(form, id='', action='Submit')
      form(method='POST', action='', id=id)
          =form.csrf_token
  
          each field in form
              fieldset
                  if field.errors
                      each error in field.errors
                          .notification.error
                              #{error}
  
                  #{field(placeholder=field.label.text)}
  
          button(type='submit') #{action}
  </code></pre>