lepture / flask-wtf / 180

100%

Pull #169

travis-ci

Abstract protect_csrf() into a separate method.

Right now, CsrfProtect._csrf_protect() does 1) check if this view should
be checked for a CSRF token, and 2) validate the actual token.

This commit abstracts 2) into a separate method so we can manually call
this method (for example on a before_request callback). This makes it
possible to do further checks before validating the CSRF (e.g. skip the
check for REST calls using OAuth).

This commit also adds a configuration parameter WTF_CSRF_CHECK_DEFAULT,
which will determine whether to check all views by default or not. It
defaults to True.

31 of 31 new or added lines in 1 file covered. (100.0%)

364 of 399 relevant lines covered (91.23%)

4.49 hits per line