python - tornado.web.stream_request_body: _xsrf missing error even with _xsrf input within html -

utilizing tornado library within python have come across unusual error. seems when have decorated file upload handler '@tornado.web.stream_request_body' webserver throws error:

warning:tornado.general:403 post /upload (ip-address): '_xsrf' argument missing post warning:tornado.access:403 post /upload (ip-address) 1.44ms 

the code governing upload follows:

@tornado.web.stream_request_body class upload(basehandler):     def prepare(self):         print self.request.headers      def data_received(self,chunk):         print chunk      @tornado.web.authenticated     def post(self):         self.redirect("/") 

where basehandler web.requesthandler subclass various helper functions (retrieving user info cookies , whatnot).

within html template, have appropriate xsrf function call seen here:

<form enctype="multipart/form-data" action="/upload" method="post" id="upload_form" class="form-upload">     {% raw xsrf_form_html() %}     <input type="file" name="upfile" required/>     <button class="btn btn-lg btn-primary btn-block-submit" type="submit">submit</button> </form> 

and generating proper xsrf input within browser:

<form enctype="multipart/form-data" action="/upload" method="post" id="upload_form" class="form-upload">     <input type="hidden" name="_xsrf" value="2|787b7c6e|4a82eabcd1c253fcabc9cac1e374e913|1430160367"/>     <input type="file" name="upfile" required/>     <button class="btn btn-lg btn-primary btn-block-submit" type="submit">submit</button> </form> 

when turn off xsrf_cookies within webserver settings, , functions normal. feel not ideal.

while xsrf_cookies set false, if given text file called "stuff.txt" body of "testfile" output is:

------webkitformboundary4ihkiqungfqverrb content-disposition: form-data; name="_xsrf"  2|787b7c6e|4a82eabcd1c253fcabc9cac1e374e913|1430160367 ------webkitformboundary4ihkiqungfqverrb content-disposition: form-data; name="upfile"; filename="stuff.txt" content-type: text/plain  testfile ------webkitformboundary4ihkiqungfqverrb-- 

from output, guess xsrf value being captured stream_request_body , not passed appropriate xsrf validation class.

any on appreciated. thank in advance!

tornado not (as of version 4.1) support streaming multi-part uploads. means uploads wish stream must simple puts, instead of post mixes uploaded data other form fields _xsrf. use xsrf protection in scenario must pass xsrf token via http header (x-xsrf-token) instead of via form field. unfortunately incompatible non-javascript web form uploads; must have client capable of setting arbitrary http headers.