asgi-csrf

What it is and what it does

asgi-csrf is ASGI middleware that defends web applications against Cross-Site Request Forgery attacks by implementing the Double Submit Cookie pattern. It automatically sets a CSRF token cookie on incoming requests and validates that token in subsequent POST requests—either as a hidden form field or as an x-csrftoken HTTP header. The middleware depends on itsdangerous for token signing and python-multipart for parsing multipart form data.

The middleware is configured by wrapping your ASGI application and providing a signing secret. It offers fine-grained control over cookie behavior (name, path, domain, secure flag, SameSite policy), can skip protection for API routes or Bearer-token requests, and supports custom error handlers. Requests without cookies or with Bearer authentication are allowed through by default, though specific paths can be marked for always-protection to defend against login CSRF.

Use it for:

• Protect traditional server-rendered web forms from CSRF attacks by validating tokens on POST requests.
• Defend login endpoints against login CSRF by marking them with always_protect to require tokens even from unauthenticated users.
• Skip CSRF checks for REST API endpoints while protecting form-based routes using skip_if_scope callbacks.
• Customize CSRF error responses for different content types or to match your application's error handling style.
• Configure cookie security settings (HTTPS-only, SameSite) to align with your deployment environment and security policy.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

ASGI middleware that protects web applications against CSRF attacks by implementing the Double Submit Cookie pattern, validating tokens in form fields or HTTP headers.

Yes, with conditions. asgi-csrf is a straightforward, low-friction implementation of a standard CSRF defense pattern with no known vulnerabilities. Install it if you are building traditional server-rendered ASGI applications that handle form submissions. However, note that maintenance is dormant (no releases in 637 days)—verify compatibility with your specific ASGI framework and Python version before committing to production, and be prepared to fork or switch if critical issues arise.

Install

asgi-csrf on PyPI

pip install asgi-csrf

uv add asgi-csrf

poetry add asgi-csrf

Installing asgi-csrf

Before you install

Low install friction with just two runtime dependencies. Maintenance is dormant—last commit was 2024-11-15 and no releases in the past 637 days—but the repository is not archived and the package remains functional for current Python versions.

License in practice

Apache-2.0 is permissive; you can use, modify, and distribute this package freely in commercial and private projects with minimal restrictions.

Quickstart

pip install asgi-csrf

from asgi_csrf import asgi_csrf

app = asgi_csrf(app, signing_secret="your-secret-key")

# In templates, include the token:
# <input type="hidden" name="csrftoken" value="{{ request.scope['csrftoken']() }}" />

Requires Python 3.9 or later; signing_secret should be configured explicitly or via ASGI_CSRF_SECRET environment variable to persist across server restarts.

Verify before relying

• Whether the dormant maintenance status (no releases in 637 days) affects compatibility with recent ASGI framework versions or Python 3.12+.
• Real-world performance impact when handling multipart form data with the python-multipart dependency.

Package facts

Evidence: asgi_csrf-0.11-py3-none-any.whl

Tags

More Security packages