Repository navigation
[BUG] Dash with CSRFProtect from Flask-WTF no longer working after Dash 4.1 to 4.2 upgrade #3827
Description
After upgrading Dash 4.1.0 to Dash 4.2.0 (while keeping Flask-WTF at 1.3.0) the application no longer works and creates the following exception: flask_wtf.csrf.CSRFError: 400 Bad Request: The CSRF token is missing.
Everything is working fine under Dash 4.1.0. Under Dash 4.2.0 it creates the following exception during callback execution:
Traceback (most recent call last):
File "C:\Users\Python\dash_test4\venv\Lib\site-packages\flask_wtf\csrf.py", line 286, in protect
validate_csrf(self._get_csrf_token())
~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\Python\dash_test4\venv\Lib\site-packages\flask_wtf\csrf.py", line 102, in validate_csrf
raise ValidationError("The CSRF token is missing.")
wtforms.validators.ValidationError: The CSRF token is missing.
During handling of the above exception, another exception occurred:
flask_wtf.csrf.CSRFError: 400 Bad Request: The CSRF token is missing.A MRE to reproduce the problem is here:
Metadata
Metadata
Assignees
Labels
No labels
Activity
camdecoster commentedon Jun 24, 2026
Thanks for the report! Our team will take a look into it, but it might take a bit.
Fix Flask-WTF/Quart-WTF CSRF exemptions broken by backend refactor
ghaarsma commentedon Jul 22, 2026
Can confirm that is has been fixed in Dash 4.4.1. Thank you @T4rk1n for the fix and new release.