Is there a way to hide the csrf label while looping through form using Flask and Flask-WTForms?

Question

I have very simple contact form and I would like to hide the label somehow so that it doesn’t show Csrf Token. I am using Flask and Flask-WTForms and am rendering the form like this:

{% for field in form %}
    {{ field.label }}
    {{ field }}
{% endfor %}

So basically this shows my inputs correctly and the csrf oen is hidden but the label isn’t hidden? Should I get over it and implicitly say form.field_name instead of looping through the form or is there a way to handle this “corner case”.

I was thinking about doing a logical check in either the for loop declaration or the label declaration but so far I haven’t found anything in the documentation that has worked.

Thanks

EDIT: I have “fixed” the problem by doing this but it feels kinda dirty and hacky which I don’t like I am still open to a better solution:

{% if not loop.first %}
    {{ field.label }}
{% endif %}

Asked By: edhedges

||

Source

Answer 1

I have found the way to do it like this:

{% if field.id != 'csrf_token' %}

I believe this to be less hacky. I found this from modifying the example here in the docs.

Answered By: edhedges

Answer 2

I think this should work too:

{% for field in form if field.id != 'csrf_token' %}
    {{ field.label }}
    {{ field }}
{% endfor %}

Answered By: doru

Answer 3

If you want a more general solution that works for all hidden fields instead of just the CSRF token:

{{ form.hidden_tag() }}
{% for field in form if field.widget.input_type != 'hidden' %}
  {{ field.label }}
  {{ field }}
{% endfor %}

form.hidden_tag() is supplied by Flask-WTF.

Answered By: jd.

Answer 4

Just to add to JD’s excellent answer…

For those stumbling across this question: You can avoid losing the (csrf) hidden field (and thus protection) by adding the condition “if field.widget.input_type!=’hidden’ ” specifically to the label instead of to the form iterator.

i.e.:

not

{{ form.hidden_tag() }}
{% for field in form if field.widget.input_type != 'hidden' %}
      {{ field.label }}
{{ field }}
{% endfor %}

but

{{ form.hidden_tag() }}
{% for field in form %}
  {% if field.widget.input_type != 'hidden' %} {{ field.label }} {% endif %}
  {{ field }}
{% endfor %}

Answered By: rnvdv

Answer 5

I made a macro recently to submit forms through ajax in order to not reload the webpage and send it to the api directly.

{% macro render_fields3(form, form_name, method) %}
<form class="ajax" name={{ form_name }} method={{ method }}>
{{ form.hidden_tag() }}
{% for field in form if field.widget.input_type != 'hidden' %}
    <dt>{{ field.label }}
    <dd>{{field(id=field.name + method)|safe}}
    {% if field.errors %}
      <ul class=errors>
      {% for error in field.errors %}
        <li>{{ error }}</li>
      {% endfor %}
      </ul>
    {% endif %}
    </dd>
  {% endfor %}

</form>
{% endmacro %}

Answered By: George Pamfilis

Is there a way to hide the csrf label while looping through form using Flask and Flask-WTForms?

Question:

Answers: