starlette-csrf
Starlette middleware implementing Double Submit Cookie technique to mitigate CSRF
Decision gist · record as of 2026-08-14
Yes, if you are building a Starlette or FastAPI application with cookie-based authentication and need CSRF protection. The package is stable, has no known vulnerabilities, and integrates cleanly with minimal dependencies. However, note that maintenance is aging (last release June 2023); verify compatibility with your current Starlette version and monitor the repository for any future security updates.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires a strong secret passphrase to be set; using the default placeholder will not provide security.
- Low friction installation with only two runtime dependencies (itsdangerous and starlette).
- Maintenance status is aging—last release was 2023-06-27 and no commits since 2025-03-15—but the package is marked Production/Stable and has seen no security vulnerabilities.
License · maintenance · safety
permissive license (permissive) — MIT license (permissive) means you can use, modify, and distribute this package freely in both open-source and commercial projects with minimal restrictions.
last release 2023-06-27 (1144 days) · last repo commit 2025-03-15 · 83 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 267,044 downloads/mo, #8,298 on PyPI
Alternatives
Verify before relying
pip install starlette-csrf
from starlette.applications import Starlette
from starlette.middleware import Middleware
from starlette_csrf import CSRFMiddleware
middleware = [Middleware(CSRFMiddleware, secret="__CHANGE_ME__")]
app = Starlette(routes=routes, middleware=middleware)- Whether the aging maintenance status (last release June 2023) affects compatibility with current Starlette versions.
- Performance impact of CSRF token validation on high-traffic applications.
- Whether cookie_secure=False default is appropriate for production deployments.
What it is and what it does
Starlette CSRF is a middleware package that guards Starlette and FastAPI applications against cross-site request forgery attacks. It implements the Double Submit Cookie pattern: on safe HTTP methods (GET, HEAD, OPTIONS, TRACE by default), it sets a cookie containing a secret token; on unsafe methods (POST, PUT, DELETE, PATCH), it requires the same token to be sent in a request header, comparing the two to verify the request originated from your application.
The middleware is configurable for different authentication schemes, URL patterns, and cookie settings. You can exempt specific URLs from CSRF checks, enforce checks on particular URLs regardless of method, or restrict CSRF validation to requests that carry certain cookies. It depends only on itsdangerous (for token signing) and starlette itself, making it lightweight to integrate into existing Starlette or FastAPI applications.
Use it for
- Protect form submissions and API endpoints in browser-based Starlette applications from CSRF attacks.
- Customize CSRF error responses (e.g., return JSON instead of plain text) by subclassing the middleware.
- Exempt specific API routes that don't require CSRF protection while enforcing it elsewhere.
- Configure different cookie domains to allow frontend and API subdomains to share CSRF tokens.
- Restrict CSRF checks to requests carrying session cookies while allowing stateless API calls.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes, if you are building a Starlette or FastAPI application with cookie-based authentication and need CSRF protection.
The package is stable, has no known vulnerabilities, and integrates cleanly with minimal dependencies. However, note that maintenance is aging (last release June 2023); verify compatibility with your current Starlette version and monitor the repository for any future security updates.
Install
starlette-csrf on PyPI
Before you install
Low friction installation with only two runtime dependencies (itsdangerous and starlette). Maintenance status is aging—last release was 2023-06-27 and no commits since 2025-03-15—but the package is marked Production/Stable and has seen no security vulnerabilities.
Requires a strong secret passphrase to be set; using the default placeholder will not provide security.
License in practice
MIT license (permissive) means you can use, modify, and distribute this package freely in both open-source and commercial projects with minimal restrictions.
Quickstart
pip install starlette-csrf
from starlette.applications import Starlette
from starlette.middleware import Middleware
from starlette_csrf import CSRFMiddleware
middleware = [Middleware(CSRFMiddleware, secret="__CHANGE_ME__")]
app = Starlette(routes=routes, middleware=middleware)Verify before relying
- Whether the aging maintenance status (last release June 2023) affects compatibility with current Starlette versions.
- Performance impact of CSRF token validation on high-traffic applications.
- Whether cookie_secure=False default is appropriate for production deployments.
Package facts
| License | permissive license permissive |
| Python support | Supports the current Python release >=3.8 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 2 packagesitsdangerousstarlette |
| Maintenance | Aging 1,144 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 267,044 / month, #8,298 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 5 - Production/StableFramework :: AsyncIOIntended Audience :: DevelopersLicense :: OSI Approved :: MIT LicenseProgramming Language :: Python :: 3 :: OnlyProgramming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.8Programming Language :: Python :: 3.9Topic :: Internet :: WWW/HTTP :: Session |
Evidence: starlette_csrf-3.0.0-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “CSRF protection middleware”
- starlette-csrfStarlette middleware that protects web applications from CSRF attacks…
- asgi-csrfASGI middleware that protects web applications against CSRF attacks…
- fastapi-csrf-protectAdds stateless CSRF protection to FastAPI applications using the…
Give your agent the search over MCP, or paste the wish link into any chat.
More WWW/HTTP packages
urllib3 is an HTTP client library that provides thread-safe connection pooling, SSL/TLS verification, multipart file uploads, request retries, compression support, and proxy handling for Python applications.
Requests is a Python HTTP library that simplifies sending HTTP/1.1 requests with automatic handling of headers, authentication, cookies, and response parsing.
h11 is a pure-Python HTTP/1.1 protocol implementation that handles parsing and serializing HTTP messages without any built-in I/O, letting you integrate it with any network layer you choose.
HTTPX is a fully featured HTTP client library for Python that provides both sync and async APIs, with support for HTTP/1.1 and HTTP/2, plus an integrated command-line client.
Install it if you are building new projects or modernizing existing ones that rely on HTTP.
A minimal low-level HTTP client library that sends HTTP requests with thread-safe and task-safe connection pooling, supporting HTTP/1.1, HTTP/2, proxies, and both sync and async interfaces.
aiohttp is an async HTTP client and server framework built on asyncio, supporting both WebSockets and middleware-based routing for building concurrent web applications.
Install it if you need async HTTP client or server capabilities in asyncio-based applications.
See also asgi-csrf · starlette-context · fastapi-csrf-protect · Secweb · starsessions · starlette-compress · piccolo-api · starlette · asgi-correlation-id · secure