Cross-site request forgery
Insecure configuration can lead to a cross-site request forgery (CRSF) vulnerability. This can enable an attacker to trick end users into performing unwanted actions while authenticated.
def csrf_protection_noncompliant():
    from flask import Flask
    app = Flask(__name__)
    # Noncompliant: disables CSRF protection.
    app.config['WTF_CSRF_ENABLED'] = False
def csrf_protection_compliant():
    from flask_wtf.csrf import CsrfProtect
    from flask import Flask
    csrf = CsrfProtect()
    app = Flask(__name__)
    # Compliant: enables CSRF protection.
    csrf.init_app(app)