title: tornado.web.stream_request_body: _xsrf missing error even with _xsrf input within html
body: <p>Utilizing the Tornado library within Python I have come across a very unusual error.  It seems that when I have decorated my file upload handler with '@tornado.web.stream_request_body' the webserver throws the error:</p>
  
  <pre><code>WARNING:tornado.general:403 POST /upload (ip-address): '_xsrf' argument missing from POST
  WARNING:tornado.access:403 POST /upload (ip-address) 1.44ms
  </code></pre>
  
  <p>The code governing the upload is as follows:</p>
  
  <pre><code>@tornado.web.stream_request_body
  class Upload(BaseHandler):
      def prepare(self):
          print self.request.headers
  
      def data_received(self,chunk):
          print chunk
  
      @tornado.web.authenticated
      def post(self):
          self.redirect("/")
  </code></pre>
  
  <p>where my BaseHandler is a web.RequestHandler subclass with various helper functions (retrieving user info from cookies and whatnot).</p>
  
  <p>Within my HTML template, I have the appropriate xsrf function call as seen here:</p>
  
  <pre><code>&lt;form enctype="multipart/form-data" action="/upload" method="post" id="upload_form" class="form-upload"&gt;
      {% raw xsrf_form_html() %}
      &lt;input type="file" name="upFile" required/&gt;
      &lt;button class="btn btn-lg btn-primary btn-block-submit" type="submit"&gt;Submit&lt;/button&gt;
  &lt;/form&gt;
  </code></pre>
  
  <p>and is generating the proper xsrf input within the browser:</p>
  
  <pre><code>&lt;form enctype="multipart/form-data" action="/upload" method="post" id="upload_form" class="form-upload"&gt;
      &lt;input type="hidden" name="_xsrf" value="2|787b7c6e|4a82eabcd1c253fcabc9cac1e374e913|1430160367"/&gt;
      &lt;input type="file" name="upFile" required/&gt;
      &lt;button class="btn btn-lg btn-primary btn-block-submit" type="submit"&gt;Submit&lt;/button&gt;
  &lt;/form&gt;
  </code></pre>
  
  <p>When I turn off xsrf_cookies within the webserver settings, all is well and everything functions as normal.  However I feel that this is not ideal.</p>
  
  <p>While xsrf_cookies is set to False, if given a text file called "stuff.txt" with a body of "testfile" the output is:</p>
  
  <pre><code>------WebKitFormBoundary4iHkIqUNgfqVErRB
  Content-Disposition: form-data; name="_xsrf"
  
  2|787b7c6e|4a82eabcd1c253fcabc9cac1e374e913|1430160367
  ------WebKitFormBoundary4iHkIqUNgfqVErRB
  Content-Disposition: form-data; name="upFile"; filename="stuff.txt"
  Content-Type: text/plain
  
  testfile
  ------WebKitFormBoundary4iHkIqUNgfqVErRB--
  </code></pre>
  
  <p>From that output, my guess is that the xsrf value is being captured by the stream_request_body and not passed to the appropriate xsrf validation class.</p>
  
  <p>Any help on this would be greatly appreciated.  Thank you in advance!</p>