title: Python, Flask WTF : token missing in session
body: <p>I have :</p>
  <ul>
  <li>Backend python Flask API</li>
  <li>React front-end (with axios for requests)</li>
  </ul>
  <p>This is my backend code for CSRF :</p>
  <pre><code>from flask import Flask
  from flask_cors import CORS
  from flask_wtf.csrf import CSRFProtect, generate_csrf
  
  app = Flask(__name__)
  CSRFProtect(app)
  CORS(app)
  
  @app.after_request
  def inject_csrf_token(response):
      csrf_token = generate_csrf()
      response.set_cookie('csrf_token', csrf_token)
      return response
  </code></pre>
  <p>Front-end code :</p>
  <pre><code>import axios from 'axios';
  import Cookies from 'js-cookie'
  
  const API_URL = `https://${window.location.hostname}:7000/v2/`;
  
  const api = axios.create({
      baseURL: API_URL,
      headers: {
          'Content-Type': 'application/json',
          'X-CSRF-Token': Cookies.get('csrf_token')
      }
  });
  
  export default api;
  </code></pre>
  <p>as you can see, when I POST request to my API, CSRF Token is here :</p>
  <blockquote>
  <p>X-CSRF-Token:
  IjNhM2YxY2ZhNDcyYzMzZDFlZjhlMWExYmMzMWNmNTI3NzFhNDhkMjki.X9Ce-Q.E_5se2uLaCaQDAiYUOMZ4kVNtBs</p>
  </blockquote>
  <p>But I'm getting this response :</p>
  <blockquote>
  <p>400 Bad Request The CSRF session token is missing.</p>
  </blockquote>
  <p>The issue seems to be in flask session : when I'm debugging <code>session</code> object from flask, token is present :</p>
  <p><a href="https://i.stack.imgur.com/CY0Bm.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/CY0Bm.png" alt="Session contains token in flask after_request handler" /></a></p>
  <p>But is is empty in Flask WTF CSRFProtect code</p>
  <p><a href="https://i.stack.imgur.com/E2h9B.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/E2h9B.png" alt="Session empty in CSRFProtect code from Flask-WTF" /></a></p>
  <p>I'm using Flask-WTF==0.14.3</p>
  <p>Any help to solve this session issue would be appreciated</p>