Store a single CSRF token per session

Signed-off-by: Patrick Uiterwijk <patrick@puiterwijk.org>
puiterwijk · Dec 8, 2017 · 42b864c · 42b864c
1 parent 26f8f82
commit 42b864c
Showing 1 changed file with 5 additions and 4 deletions.
diff --git a/flask_oidc/__init__.py b/flask_oidc/__init__.py
@@ -532,10 +532,11 @@ def redirect_to_auth_server(self, destination, customstate=None):
         .. deprecated:: 1.0
            Use :func:`require_login` instead.
         """
-        csrf_token = urlsafe_b64encode(os.urandom(24)).decode('utf-8')
-        session['oidc_csrf_token'] = csrf_token
+        if 'oidc_csrf_token' not in session:
+            csrf_token = urlsafe_b64encode(os.urandom(24)).decode('utf-8')
+            session['oidc_csrf_token'] = csrf_token
         state = {
-            'csrf_token': csrf_token,
+            'csrf_token': session['oidc_csrf_token'],
         }
         statefield = 'destination'
         statevalue = destination
@@ -662,7 +663,7 @@ def _process_callback(self, statefield):
         """
         # retrieve session and callback variables
         try:
-            session_csrf_token = session.pop('oidc_csrf_token')
+            session_csrf_token = session.get('oidc_csrf_token')
 
             state = _json_loads(urlsafe_b64decode(request.args['state'].encode('utf-8')))
             csrf_token = state['csrf_token']