{"repo":"aekasitt/fastapi-csrf-protect","free":true,"listed":false,"github":"https://github.com/aekasitt/fastapi-csrf-protect","clone":"git clone https://github.com/aekasitt/fastapi-csrf-protect.git","description":"Stateless implementation of Cross-Site Request Forgery (XSRF) Protection by using Double Submit Cookie mitigation pattern","language":"Python","stars":108,"topics":["asgi","csrf","fastapi","security","xsrf"],"license":"MIT","category":"security-tools","readme_excerpt":"FastAPI CSRF Protect Features FastAPI extension that provides stateless Cross-Site Request Forgery (XSRF) Protection support. Aimed to be easy to use and lightweight, we adopt Double Submit Cookie mitigation pattern. If you were familiar with flask-wtf library this extension suitable for you. This extension inspired by fastapi-jwt-auth 😀 - Storing fastapi-csrf-token in cookies or serve it in template's context Installation The easiest way to start working with this extension with pip Getting Started The following examples show you how to integrate this extension to a FastAPI App Example Login Form How to send the CSRF token in your client code HTML Form (Server-side rendered) AJAX (JavaScript) [!IMPORTANT] - The flexible sub-package ignores the token location setting — tokens from either header or body are always accepted. - CSRF token validation still requires a matching CSRF cookie as in the base package. - Priority is given to header over body when both are present. 📌 Flexible Mode (fastapi csrf protect.flexible) Some applications combine Server-Side Rendering (SSR) with API endpoints in the same project. For example: - SSR pages rendered with Jinja2 templates that use HTML forms (CSRF token in form body ) - AJAX / API calls (e.g. DELETE, PUT, PATCH) that pass the CSRF token in the HTTP header The main fastapi-csrf-protect package is opinionated and expects the CSRF token in one location only (either header or body). For hybrid apps, this can be inconvenient. The flexibl","default_branch":null,"files":null,"tree":[],"storefront":"/r/aekasitt","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/aekasitt/fastapi-csrf-protect/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}