Send CSRF token with fetch

Put the token in a meta tag and send it as X-CSRFToken from JavaScript.

flask beginner #csrf#security#javascript
Open in playground
flask-wtf-csrf-fetch.py
# base.html
# <meta name="csrf-token" content="{{ csrf_token() }}">

# app.py
from flask_wtf import CSRFProtect
csrf = CSRFProtect(app)

# JavaScript
# const token = document.querySelector('meta[name="csrf-token"]').content;
# fetch("/api/items", {
#   method: "POST",
#   headers: {"Content-Type": "application/json", "X-CSRFToken": token},
#   body: JSON.stringify({name: "Notebook"}),
# });