An HTML `` `` element to be included with all POST forms. It defines the ``_xsrf`` input value, which we check on all POST requests to prevent cross-site request forgery. If you have set the ``xsrf_cookies`` application setting, you must include this HTML with
(self)
| 1530 | raise HTTPError(403, "XSRF cookie does not match POST argument") |
| 1531 | |
| 1532 | def xsrf_form_html(self) -> str: |
| 1533 | """An HTML ``<input/>`` element to be included with all POST forms. |
| 1534 | |
| 1535 | It defines the ``_xsrf`` input value, which we check on all POST |
| 1536 | requests to prevent cross-site request forgery. If you have set |
| 1537 | the ``xsrf_cookies`` application setting, you must include this |
| 1538 | HTML within all of your HTML forms. |
| 1539 | |
| 1540 | In a template, this method should be called with ``{% module |
| 1541 | xsrf_form_html() %}`` |
| 1542 | |
| 1543 | See `check_xsrf_cookie()` above for more information. |
| 1544 | """ |
| 1545 | return ( |
| 1546 | '<input type="hidden" name="_xsrf" value="' |
| 1547 | + escape.xhtml_escape(self.xsrf_token) |
| 1548 | + '"/>' |
| 1549 | ) |
| 1550 | |
| 1551 | def static_url( |
| 1552 | self, path: str, include_host: Optional[bool] = None, **kwargs: Any |