# BadRequest: The CSRF token is missing.

- **ID:** `python/flask-form-csrf-token-missing`
- **Domain:** python
- **Category:** auth_error
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

Flask-WTF CSRFProtect is enabled but the HTML form lacks {{ csrf_token() }} or the AJAX request omits the X-CSRFToken header.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| 3.x | active | — | — |

## Workarounds

1. **** (93% success)
   ```
   In template: <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
   ```
2. **** (90% success)
   ```
   In AJAX: headers: {'X-CSRFToken': getCookie('csrf_token')}
   ```

## Dead Ends

- **** — Disables CSRF protection entirely; security risk. (30% fail)
- **** — Flask-WTF looks for form field or header, not JSON. (70% fail)