FlaskWTF

Flask-WTF is a Flask extension that integrates WTForms with Flask applications to simplify form handling, validation, and CSRF protection. It introduces the FlaskForm class, which developers subclass to declare fields and validators, and provides convenient rendering helpers for templates. The extension relies on WTForms for field types and validation logic and on Flask’s session and CSRF mechanisms to protect forms from cross-site request forgery.

Key features include seamless WTForms integration, built-in CSRF protection enabled by default through the app’s secret key, and straightforward rendering of form fields in Jinja2 templates. It also supports common form-related tasks such as file uploads via FileField, Recaptcha fields, and internationalization hooks via WTForms. Configuration options allow customization of CSRF behavior, including enabling/disabling CSRF and adjusting time limits with settings like WTF_CSRF_ENABLED and WTF_CSRF_TIME_LIMIT.

Usage basics: install with pip install Flask-WTF. In a Flask app, set a secret key (required for CSRF): app.config['SECRET_KEY'] = 'your-secret-key'. Define forms by subclassing FlaskForm and declaring fields and validators, for example a login form with username and password fields. In routes, instantiate the form and call form.validate_on_submit() to process valid submissions. In templates, render fields and include form.csrf_token to ensure CSRF protection.

Flask-WTF is open source, BSD-3-Clause licensed, and widely used in the Flask ecosystem. It is commonly referred to as Flask-WTF, with Flask-WTF or FlaskWTF as acceptable variants. Documentation and source are available on its PyPI page and GitHub repository.