I have a flask app with jwt_extended config as auth. For all pages, it works without any issue. But for pages with a form and post methods, when I submit the form, the app redirect me to the login page in loop ( even if I log or already loggued ).

If I put : JWT_COOKIE_CSRF_PROTECT = False I don't have any issue

search/search.html

{% extends "base.html" %}

{% block content %}

<nav class="uploadbar">
    <form id="form-navbar" method="POST" action="/search/" class="form-inline formupload" enctype="multipart/form-data">
        <input id="host-navbar-upload" class="form-control mr-sm-2" name="hostname-list" type="file" accept=".csv" placeholder="Upload a csv file..." aria-label="Upload">
        <button id="upload-navbar" class="btn btn-primary my-2 my-sm-0 button-form-upload" type="submit">Upload</button>
    </form>
  </nav>

 {% endblock %}

auth/routes.py

from app.auth import bp
from flask import current_app

from app.extensions import ldap

from flask import (
    g, 
    render_template, 
    request, 
    session, 
    redirect, 
    url_for, 
    jsonify, 
    make_response,
    flash
)

from flask_jwt_extended import (
    create_access_token, 
    create_refresh_token, 
    set_access_cookies, 
    set_refresh_cookies, 
    unset_jwt_cookies, 
    get_jwt_identity
)

from flask_jwt_extended import jwt_required

@bp.route('/')
@jwt_required()
def index():
    return jsonify('Login Successfull')

@bp.route("/login/", methods=["GET","POST"])
def login():
    if g.user:
        return redirect(url_for("dashboard.dashboard"))
    
    if request.method == "POST":
        user = request.form["username"]
        passwd = request.form["password"]
        test = ldap.bind_user(user, passwd)
    
        if test is None or passwd == "":
            flash('Invalid username or password. Please try again.', 'danger') 
            current_app.logger.info('Invalid password for user : %s', user)
      
        else:
            access_token = create_access_token(identity=user)
            refresh_token = create_refresh_token(identity=user)
            response = make_response(redirect(url_for('dashboard.dashboard')))
            set_access_cookies(response, access_token)
            set_refresh_cookies(response, refresh_token)
            
            return response

    return render_template('auth/login.html',title='Login')

@bp.route("/token/refresh", methods=["POST"])
@jwt_required(refresh=True)
def refresh():
    identity = get_jwt_identity()
    access_token = create_access_token(identity=identity)

    return jsonify(access_token=access_token)

@bp.route("/logout/")
@jwt_required()
def logout():
    response = make_response(redirect(url_for("auth.login")))
    unset_jwt_cookies(response)

    return response

search/routes.py

from app.search import bp
from flask import render_template
from flask import request
from app.extensions import db, ldap
from flask import current_app as app
from flask_jwt_extended import jwt_required
import pandas as pd
from app.utils import df_parser

@bp.route('/', methods=["GET", "POST"])
@jwt_required()
def search():
    
    host = 'vautour2'

    if request.method == "POST":
        df = pd.read_csv(request.files.get('hostname-list'))
        df = df_parser(df)
        hostlist = df['name'].tolist()

        print(hostlist)
            
    return render_template('search/search.html',title='Search',
        host=host,
    )

@bp.route('/result/', methods=["GET", "POST"])
@jwt_required()
def result():

    if request.method == "POST":
        host = request.form["hostname"]
    
    return render_template('search/result.html',title='Search result',
        host=host,
    )

Any idea ?