flask_jwt_extended不检查报头中的X-CSRF-TOKEN

from flask import Flask, request, jsonify
from flask_jwt_extended import JWTManager, jwt_required, create_access_token, get_jwt_identity

app = Flask(__name__)
app.config['JWT_SECRET_KEY'] = 'super-secret'  # 替换为你的密钥
jwt = JWTManager(app)

# 模拟一个 CSRF 令牌存储
csrf_tokens = {}

@app.route('/login', methods=['POST'])
def login():
    username = request.json.get('username', None)
    password = request.json.get('password', None)
    if username != 'test' or password != 'test':
        return jsonify({"msg": "Bad username or password"}), 401

    access_token = create_access_token(identity=username)
    csrf_token = generate_csrf_token()
    csrf_tokens[username] = csrf_token

    return jsonify(access_token=access_token, csrf_token=csrf_token), 200

@app.route('/protected', methods=['GET'])
@jwt_required()
def protected():
    current_user = get_jwt_identity()
    if request.headers.get('X-CSRF-TOKEN') != csrf_tokens.get(current_user):
        return jsonify({"msg": "CSRF token mismatch"}), 403

    return jsonify(logged_in_as=current_user), 200

def generate_csrf_token():
    import secrets
    return secrets.token_hex(16)

if __name__ == '__main__':
    app.run()