# Pre-req script to set 'csrf-token' var for POST req in Flask

**URL:** <https://community.postman.com/t/pre-req-script-to-set-csrf-token-var-for-post-req-in-flask/51398>\
**Category:** Help Hub\
**Tags:** development, csrf\
**Created:** [September 5, 2023, 9:43pm UTC](https://community.postman.com/t/pre-req-script-to-set-csrf-token-var-for-post-req-in-flask/51398 "2023-09-05T21:43:09Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![kallenatgmail](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/kallenatgmail/32/25605_2.png) [@kallenatgmail](https://community.postman.com/u/kallenatgmail)\
**Post date:** [September 5, 2023, 9:43pm UTC](https://community.postman.com/t/pre-req-script-to-set-csrf-token-var-for-post-req-in-flask/51398/1 "2023-09-05T21:43:09Z")

</div>

Hello. I’ve found related answers to this in my search, but this isn’t quite working. I’m trying to use Postman to 1) register test users in my Flask site, 2) test duplicate registration. The Flask app presents the csrf-token in a hidden field in the html. In order to test user registration, I think I need to create a Postman pre-request script to grab that csrf-token and set it in a variable which the registration test will use. Here’s what I have:

In this first screenshot you see the setup of the form-data being sent to register a user. Is this the correct way to set the csrf-token as a variable. Below in the screenshot I’m showing the html output generated by the GET pre-req script, noting the csrf-token in the hidden field.

 ![ss-postman1](https://us1.discourse-cdn.com/getpostman/original/3X/2/4/24bb15c7482fba4e130f5275143d1fd8d0c5239b.png)

In this second screenshot I show the pre-req script and the request body that the POST is sending. You can see the csrf-token is blank.

 ![ss-postman2](https://us1.discourse-cdn.com/getpostman/original/3X/8/f/8fb0fb8b46e661b00d485ab7212794f2dde1490f.png)

Last, here is a demonstration of running a proof of concept via node. This code should work in Postman, but I’m missing something..

```auto
(.venv) 09/05 14:21[wintermute on alt_config]
$ cat scrape.js
const request = require('request');
const cheerio = require('cheerio');
request('http://localhost:8003/register', (error, response, html) => {
  if(!error && response.statusCode == 200) {
      const $ = cheerio.load(html);
      const contentSection = $('.content-section');
      //console.log(contentSection);
      //console.log(contentSection.html());
      console.log(contentSection.find('[name="csrf_token"]').attr('value'));
  }
});
(.venv) 09/05 14:21[wintermute on alt_config]
$ node scrape.js
ImUwNTFjNDBkMmRkMjRmYmViZmQzMzIxMTAwYzgxNzNjZmY0ZGVmYzgi.ZPeb5g.Q3ooiVHWNPBmIpdI3WwbUNpuEMU

```

Where am I going wrong? How do I get this csrf-token variable set in the pre-req so that the POST req can use it?

Thanks!

---

<div class="post-metadata">

**Author:** ![danny-dainton](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/danny-dainton/32/29401_2.png) [@danny-dainton](https://community.postman.com/u/danny-dainton)\
**Post date:** [September 7, 2023, 1:37pm UTC](https://community.postman.com/t/pre-req-script-to-set-csrf-token-var-for-post-req-in-flask/51398/2 "2023-09-07T13:37:41Z")

</div>

Hey @kallenatgmail 👋

Welcome to the Postman Community! :postman:

In your `pm.sendRequest` you using an arg called `html` and then using that in the `cheerio.load()`.

If you’re using `pm.sendRequest` and are looking to use the response from that call, I would try and use `cheerio.load(response.text())` to see if that give you what you need to extract the token.

Related post:

> [@Using pm.sendRequest with an html reponse](https://community.postman.com/t/using-pm-sendrequest-with-an-html-reponse/18654):
>
> Is it possible to render an html reponse using sendRequest? Our logIn page uses html reponse and there’s where I obtain a csrf token to then log in, I’d like to know if I can do this as if I’m using cheerio(pm.response.text() This is how I’m trying currently

---

<div class="post-metadata">

**Author:** ![kallenatgmail](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/kallenatgmail/32/25605_2.png) [@kallenatgmail](https://community.postman.com/u/kallenatgmail)\
**Post date:** [September 9, 2023, 6:30am UTC](https://community.postman.com/t/pre-req-script-to-set-csrf-token-var-for-post-req-in-flask/51398/3 "2023-09-09T06:30:39Z")

</div>

Thanks for the tip. However, it didn’t work for me. I now have this script:

```auto
pm.sendRequest({
    url: "localhost:8003/register",
    method: "GET"
}, function(error, response){
      //console.log(response.text())
      const $ = cheerio.load(response.text());
      const contentSection = $('content-section');
      console.log(contentSection);
      let csrfToken = $(contentSection.find('[name="csrf_token"]').attr('value'));
      pm.globals.set("csrfToken", csrfToken);
      console.log(csrfToken);
});

```

The client sent something in request body, but it’s wrong:

 ![Screenshot 2023-09-08 at 11.16.09 PM](https://us1.discourse-cdn.com/getpostman/original/3X/8/d/8d54e9612710aaad0c69bce9e3e5a45cf9f18010.png)

Here’s what console.log of csrfToken looks like:

 ![Screenshot 2023-09-08 at 11.14.55 PM](https://us1.discourse-cdn.com/getpostman/original/3X/1/8/18b6b29c148638109e8003aff59ba90a5e12af97.png)

---

<div class="post-metadata">

**Author:** ![danny-dainton](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/danny-dainton/32/29401_2.png) [@danny-dainton](https://community.postman.com/u/danny-dainton)\
**Post date:** [September 9, 2023, 7:08am UTC](https://community.postman.com/t/pre-req-script-to-set-csrf-token-var-for-post-req-in-flask/51398/4 "2023-09-09T07:08:40Z")

</div>

What does the response body of the request, send via the pre-request look like? You should be able to get that from the console output.

Ensure that `/register` call in the async `sendRequest` is returning the correct information before trying the parse the HTML with cheerio.

---

<div class="post-metadata">

**Author:** ![kallenatgmail](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/kallenatgmail/32/25605_2.png) [@kallenatgmail](https://community.postman.com/u/kallenatgmail)\
**Post date:** [September 9, 2023, 11:40pm UTC](https://community.postman.com/t/pre-req-script-to-set-csrf-token-var-for-post-req-in-flask/51398/5 "2023-09-09T23:40:19Z")

</div>

The response body looks as I expect. This is a portion of it:

 ![Screenshot 2023-09-09 at 4.24.09 PM](https://us1.discourse-cdn.com/getpostman/original/3X/5/4/545c113d9062d0cea00efb3ed4b0753d55431a65.png)

FWIW, the proof of concept I show in my original post, using node, worked wherein I loaded cheerio with the html and I was able to ‘find’ the token in the ‘contentSection’. I know that node and pm aren’t the same, but I’m puzzled.

---

<div class="post-metadata">

**Author:** ![danny-dainton](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/danny-dainton/32/29401_2.png) [@danny-dainton](https://community.postman.com/u/danny-dainton)\
**Post date:** [September 11, 2023, 11:39am UTC](https://community.postman.com/t/pre-req-script-to-set-csrf-token-var-for-post-req-in-flask/51398/6 "2023-09-11T11:39:10Z")

</div>

Hey @kallenatgmail

I used a Mock Server and a slimmed down version of your response body.

My script is not using the `.find` and is picking up that token value from an async call.

```auto
    const $ = cheerio.load(response.text());

    let csrfToken = $('[name=csrf_token]').attr('value');

    console.log(csrfToken);

```

 ![image](https://us1.discourse-cdn.com/getpostman/original/3X/2/f/2f55b78b92a9fc04260be1f7e72e4a0cda422c46.png)

---

<div class="post-metadata">

**Author:** ![kallenatgmail](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/kallenatgmail/32/25605_2.png) [@kallenatgmail](https://community.postman.com/u/kallenatgmail)\
**Post date:** [September 12, 2023, 6:56am UTC](https://community.postman.com/t/pre-req-script-to-set-csrf-token-var-for-post-req-in-flask/51398/7 "2023-09-12T06:56:48Z")

</div>

That worked! thank you!! I wonder why the different attempts failed. Some other time.

 ![Screenshot 2023-09-11 at 11.55.17 PM](https://us1.discourse-cdn.com/getpostman/original/3X/0/9/09592abc6bdf51466d7abc8472257d909cf02a1a.png)

---

<div class="post-metadata">

**Author:** ![system](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/system/32/29796_2.png) [@system](https://community.postman.com/u/system)\
**Post date:** [December 11, 2023, 6:57am UTC](https://community.postman.com/t/pre-req-script-to-set-csrf-token-var-for-post-req-in-flask/51398/8 "2023-12-11T06:57:41Z")

</div>

Closed on December 11, 2023, 6:57am UTC

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.