{"categories":[{"label":"Security","url":"https://skillfed.io/packages/category/security/2"}],"enrichment":{"capability":"ASGI middleware that protects web applications against CSRF attacks by implementing the Double Submit Cookie pattern, validating tokens in form fields or HTTP headers.","skillfed_tags":["csrf-protection","asgi-middleware","web-security"],"use_cases":["Protect traditional server-rendered web forms from CSRF attacks by validating tokens on POST requests.","Defend login endpoints against login CSRF by marking them with always_protect to require tokens even from unauthenticated users.","Skip CSRF checks for REST API endpoints while protecting form-based routes using skip_if_scope callbacks.","Customize CSRF error responses for different content types or to match your application's error handling style.","Configure cookie security settings (HTTPS-only, SameSite) to align with your deployment environment and security policy."],"what_it_does":"asgi-csrf is ASGI middleware that defends web applications against Cross-Site Request Forgery attacks by implementing the Double Submit Cookie pattern. It automatically sets a CSRF token cookie on incoming requests and validates that token in subsequent POST requests\u2014either as a hidden form field or as an x-csrftoken HTTP header. The middleware depends on itsdangerous for token signing and python-multipart for parsing multipart form data.\n\nThe middleware is configured by wrapping your ASGI application and providing a signing secret. It offers fine-grained control over cookie behavior (name, path, domain, secure flag, SameSite policy), can skip protection for API routes or Bearer-token requests, and supports custom error handlers. Requests without cookies or with Bearer authentication are allowed through by default, though specific paths can be marked for always-protection to defend against login CSRF.","worth_installing":"Yes, with conditions. asgi-csrf is a straightforward, low-friction implementation of a standard CSRF defense pattern with no known vulnerabilities. Install it if you are building traditional server-rendered ASGI applications that handle form submissions. However, note that maintenance is dormant (no releases in 637 days)\u2014verify compatibility with your specific ASGI framework and Python version before committing to production, and be prepared to fork or switch if critical issues arise."},"id":"asgi-csrf","links":{"html":"https://skillfed.io/packages/asgi-csrf","md":"https://skillfed.io/packages/asgi-csrf.md","pypi":"https://pypi.org/project/asgi-csrf/"},"maintenance":{"status":"dormant"},"meta":{"latest_release":"2024-11-15","license_spdx":null,"license_treatment":"permissive","name":"asgi-csrf","python_support":"supports_current","summary":"ASGI middleware for protecting against CSRF attacks"},"popularity":{"monthly_downloads":166658,"position":10484,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"0.11"}