csrf-starlette-fastapi
Dead simple CSRF security middleware for Starlette
- Will work with either a
field or ajax request headers, interchangeably. - Uses stateless Double Submit Cookie method, like Django.
- Tiny, easy to audit.
Install
Add csrf_middleware.py to your project /middleware folder.
Add to Starlette
from starlette.applications import Starlette
from starlette.middleware import Middleware
from middleware.csrf_middleware import CSRFMiddleware
routes = ...
middleware = [
Middleware(CSRFMiddleware)
]
app = Starlette(routes=routes, middleware=middleware)
Add to FastAPI
from fastapi import FastAPI
from middleware.csrf_middleware import CSRFMiddleware
app = FastAPI()
app.add_middleware(CSRFMiddleware)
Usage
- Use directly in HTML.
- Pass
request.state.csrftokento your template engine.
- Pass
- Use javascript / ajax frameworks such as the elegant htmx
♥️ - Before your ajax call, set your headers.
- Most frameworks:
headers: { 'csrftoken': '{{ csrftoken }}' } - XMLHttpRequest.setRequestHeader()
- Most frameworks:
- Before your ajax call, set your headers.
- Another htmx
♥️ solution.
Why?
To make available something more simple and auditable than the typical libraries for this as of 2022:
- https://github.com/simonw/asgi-csrf
- https://github.com/frankie567/starlette-csrf
- https://github.com/piccolo-orm/piccolo_api/blob/master/piccolo_api/csrf/middleware.py
Do I need CSRF Middleware?
Maybe? Maybe not?
107 Jan 5, 2023
229 Dec 21, 2022
683 Jan 3, 2023
0 Sep 19, 2022
46 Sep 1, 2022
4 Aug 11, 2022
11 Oct 28, 2022
13 Mar 24, 2022
110 Feb 16, 2021
27 Oct 16, 2022
14 May 2, 2021
225 Jan 5, 2023
562 Jan 1, 2023
63 Dec 30, 2022