--- id: asgi-csrf version: "0.11" license: Apache-2.0 license_treatment: permissive maintenance: dormant --- # asgi-csrf — ASGI middleware for protecting against CSRF attacks License: permissive · Maintenance: dormant · Downloads: 166.7K/mo ## What it is and what it does asgi-csrf is ASGI middleware that defends web applications against Cross-Site Request Forgery attacks by implementing the Double Submit Cookie pattern. It automatically sets a CSRF token cookie on incoming requests and validates that token in subsequent POST requests—either as a hidden form field or as an x-csrftoken HTTP header. The middleware depends on itsdangerous for token signing and python-multipart for parsing multipart form data. The middleware is configured by wrapping your ASGI application and providing a signing secret. It offers fine-grained control over cookie behavior (name, path, domain, secure flag, SameSite policy), can skip protection for API routes or Bearer-token requests, and supports custom error handlers. Requests without cookies or with Bearer authentication are allowed through by default, though specific paths can be marked for always-protection to defend against login CSRF. Use it for: - Protect traditional server-rendered web forms from CSRF attacks by validating tokens on POST requests. - Defend login endpoints against login CSRF by marking them with always_protect to require tokens even from unauthenticated users. - Skip CSRF checks for REST API endpoints while protecting form-based routes using skip_if_scope callbacks. - Customize CSRF error responses for different content types or to match your application's error handling style. - Configure cookie security settings (HTTPS-only, SameSite) to align with your deployment environment and security policy. ## Worth the install? AI-flagged interpretation of the facts above — verify before relying. ASGI middleware that protects web applications against CSRF attacks by implementing the Double Submit Cookie pattern, validating tokens in form fields or HTTP headers. Yes, with conditions. asgi-csrf is a straightforward, low-friction implementation of a standard CSRF defense pattern with no known vulnerabilities. Install it if you are building traditional server-rendered ASGI applications that handle form submissions. However, note that maintenance is dormant (no releases in 637 days)—verify compatibility with your specific ASGI framework and Python version before committing to production, and be prepared to fork or switch if critical issues arise. ## Install pip install asgi-csrf uv add asgi-csrf poetry add asgi-csrf ## Installing asgi-csrf Before you install: Low install friction with just two runtime dependencies. Maintenance is dormant—last commit was 2024-11-15 and no releases in the past 637 days—but the repository is not archived and the package remains functional for current Python versions. License in practice: Apache-2.0 is permissive; you can use, modify, and distribute this package freely in commercial and private projects with minimal restrictions. Quickstart: pip install asgi-csrf from asgi_csrf import asgi_csrf app = asgi_csrf(app, signing_secret="your-secret-key") # In templates, include the token: # Requires Python 3.9 or later; signing_secret should be configured explicitly or via ASGI_CSRF_SECRET environment variable to persist across server restarts. Verify before relying: - Whether the dormant maintenance status (no releases in 637 days) affects compatibility with recent ASGI framework versions or Python 3.12+. - Real-world performance impact when handling multipart form data with the python-multipart dependency. ## Package facts - License: Apache-2.0 (permissive) - Python support: supports_current - Install friction: low - Maintenance: dormant - Downloads: 166.7K/month (top 15,000 on PyPI) - Known vulnerabilities: none known ## Tags csrf protection middleware, asgi security middleware, cross-site request forgery prevention, double submit cookie pattern, token validation asgi, web application csrf defense, form token middleware, csrf-protection, asgi-middleware, web-security [View on SkillFed](https://skillfed.io/packages/asgi-csrf) · [View on PyPI](https://pypi.org/project/asgi-csrf/)