# BadRequest: The CSRF token is missing.

- **ID:** `python/flask-csrf-token-error`
- **Domain:** python
- **Category:** auth_error
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

Flask-WTF or similar CSRF protection requires a token in the form, but it is not included in the request.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| 3.x | active | — | — |

## Workarounds

1. **** (95% success)
   ```
   Include the CSRF token in the form: {{ form.csrf_token }} or <input type='hidden' name='csrf_token' value='{{ csrf_token() }}'>
   ```
2. **** (90% success)
   ```
   For AJAX requests, set the X-CSRFToken header using the token from the cookie.
   ```

## Dead Ends

- **** — Disabling CSRF protection globally exposes the app to CSRF attacks. (90% fail)
- **** — Adding a hidden field manually without the correct token value does not work. (70% fail)