asgi-csrf

library0.11pypypiunverified

ASGI middleware for protecting against CSRF attacks. Current version 0.11. Release cadence is irregular, last release 2023-02-06.

web-framework auth-security

pip install asgi-csrf

github ↗package ↗changelog ↗

INSTALL

IMPORT

SIG · ASGI-CSRF

asgi-csrf

web-frameworkpythonv0.11

Install

1.6s avg

Import

—

Disk

16MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v0.11 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.000s · 18.2MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 1.6s · import 0.000s · 19MB

16MB installed

● package 16MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

ASGICSRFMiddleware

✓ from asgi_csrf import ASGICSRFMiddleware

✗ from asgi_csrf import ASGICSRFMiddleware

Wrap any ASGI app with CSRF protection. Secret must be set.

from asgi_csrf import ASGICSRFMiddleware from starlette.applications import Starlette from starlette.responses import PlainTextResponse app = Starlette() @app.route('/protected') async def protected(request): return PlainTextResponse('OK') app = ASGICSRFMiddleware(app, secret='my-secret')

Debug

Known issues

breakingVersion 0.11 switched from setup.py to pyproject.toml. If you depend on old build system, this may break.

fix

Update to 0.11 and ensure build tooling supports PEP 621.

affects: <0.11

gotchaIf you do not get a CSRF token cookie set, check that your response contains a form with a CSRF hidden input, or set always_set_cookie=True.

fix

Add always_set_cookie=True to middleware initialization.

affects: all

gotchaRequests with an Authorization: Bearer header are NOT subject to CSRF checks. This is by design but can be a footgun if you expect CSRF for API endpoints using Bearer tokens.

fix

Do not rely on CSRF protection for Bearer token endpoints.

affects: >=0.6

deprecatedThe send_csrf_failed argument (custom error page) is available since 0.10. No deprecation yet, but old pattern of catching errors may break.

fix

Use send_csrf_failed callback instead of custom exception handling.

affects: <0.10

Upgrade

Version history

0.11latest on PyPI · released Nov 15, 2024

Audit

Dependencies

itsdangerousrequiredUsed for signing CSRF tokens

asgirefrequiredASGI utilities

Agent activity

38 hits · last 30 days

node

Amazon

OpenAI (training)

Resources

githubhttps://github.com/simonw/asgi-csrf ↗

packagehttps://pypi.org/project/asgi-csrf/ ↗

changeloghttps://github.com/simonw/asgi-csrf/releases ↗