Documentation examples for double submit removed from latest documentation.

[bostonareahuman]

Documentation examples for double submit removed from latest documentation.

[vimalloc]

They still exist: https://flask-jwt-extended.readthedocs.io/en/stable/token_locations.html#cookies

[bostonareahuman]

The javascript does but not the overall FLASK that will initiate the cookies and how they should be implemented...older versions of the docs had this.

[vimalloc]

It's at the very top of the same page. https://flask-jwt-extended.readthedocs.io/en/stable/token_locations.html

[bostonareahuman]

The top code doesn't contain the CSRF of the whole example put together...it just contains the access cookie.. I'm spitting hairs but previous version had a full examples of double submission JWT.... it would be helpful...

[vimalloc]

That is all the code… you don’t need to do anything to prevent csrf attacks other then what is in that example.

By default, csrf protection is enabled when storing your jwts in cookies. The set_access_cookie call will set both the jwt in an httponly cookies, as well as the double submit token in a non httponly cookie