{"categories":[{"label":"Session","url":"https://skillfed.io/packages/category/internet-www-http-session"}],"enrichment":{"capability":"Starlette middleware that protects web applications from CSRF attacks using the Double Submit Cookie technique, validating that unsafe requests include a matching token in both a cookie and a request header.","skillfed_tags":["csrf-protection","middleware","authentication"],"use_cases":["Protect form submissions and API endpoints in browser-based Starlette applications from CSRF attacks.","Customize CSRF error responses (e.g., return JSON instead of plain text) by subclassing the middleware.","Exempt specific API routes that don't require CSRF protection while enforcing it elsewhere.","Configure different cookie domains to allow frontend and API subdomains to share CSRF tokens.","Restrict CSRF checks to requests carrying session cookies while allowing stateless API calls."],"what_it_does":"Starlette CSRF is a middleware package that guards Starlette and FastAPI applications against cross-site request forgery attacks. It implements the Double Submit Cookie pattern: on safe HTTP methods (GET, HEAD, OPTIONS, TRACE by default), it sets a cookie containing a secret token; on unsafe methods (POST, PUT, DELETE, PATCH), it requires the same token to be sent in a request header, comparing the two to verify the request originated from your application.\n\nThe middleware is configurable for different authentication schemes, URL patterns, and cookie settings. You can exempt specific URLs from CSRF checks, enforce checks on particular URLs regardless of method, or restrict CSRF validation to requests that carry certain cookies. It depends only on itsdangerous (for token signing) and starlette itself, making it lightweight to integrate into existing Starlette or FastAPI applications.","worth_installing":"Yes, if you are building a Starlette or FastAPI application with cookie-based authentication and need CSRF protection. The package is stable, has no known vulnerabilities, and integrates cleanly with minimal dependencies. However, note that maintenance is aging (last release June 2023); verify compatibility with your current Starlette version and monitor the repository for any future security updates."},"id":"starlette-csrf","links":{"html":"https://skillfed.io/packages/starlette-csrf","md":"https://skillfed.io/packages/starlette-csrf.md","pypi":"https://pypi.org/project/starlette-csrf/"},"maintenance":{"status":"aging"},"meta":{"latest_release":"2023-06-27","license_spdx":null,"license_treatment":"permissive","name":"starlette-csrf","python_support":"supports_current","summary":"Starlette middleware implementing Double Submit Cookie technique to mitigate CSRF"},"popularity":{"monthly_downloads":267044,"position":8298,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"3.0.0"}