How is CSRF handled in flask-restless?

[italomaia]

Does it have CSRF? How is it handled?

[jfinkels]

Flask-Restless does not do anything specific to handle CSRF tokens. But I'm not sure that it should. I think it may be beyond the scope of Flask-Restless, i.e. the user should handle adding a CSRFToken header by using, say, preprocessors and postprocessors. This is because Flask-Restless is "session-agnostic": it doesn't require any knowledge about the user's session management.

However, I would be willing to consider a pull request adding CSRFToken headers if it is simple for the user and applicable in most situations.