{"repo":"feliperalmeida/django-modern-csrf","free":true,"listed":false,"github":"https://github.com/feliperalmeida/django-modern-csrf","clone":"git clone https://github.com/feliperalmeida/django-modern-csrf.git","description":"Django modern CSRF protection using Fetch Metadata request headers instead of tokens.","language":"Python","stars":53,"topics":["csrf","django","protection","security"],"license":"Apache-2.0","category":"security-tools","readme_excerpt":"django-modern-csrf Django modern CSRF protection using Fetch metadata request headers, without tokens, cookies or custom headers. No more CSRF token errors, csrf token in your templates or configuring frontend clients to deal with X-CSRFToken . Rationale Django's default CSRF protection relies on tokens and cookies. While this works well and is secure, there are more modern ways to protect against CSRF attacks, without requiring to submit CSRF tokens to the server via forms, cookies or custom headers. Fetch metadata request headers provide a way to protect against CSRF attacks without requiring token verifications. The Sec-Fetch-Site in particular, tells the server whether the request is same origin, cross-origin, same site or user initiated. With that information, the server can decide whether to allow the request or not. To learn more about Fetch metadata request headers and how they can be used for web security, check out this article by Google. According to Can I Use, the Sec-Fetch-Site header is supported by 97.63% and Origin by 99.83% of all tracked browsers. Installation This package is designed to require minimal changes to your existing Django project. 1. Install the package: 2. Add modern csrf to your INSTALLED APPS : 3. Replace the default CSRF middleware with the new one (in the same position): 4. That should be it for most projects. However, if you are using the @csrf protect decorator, you will need to replace it with this package's @csrf protect . 5. That's it!","default_branch":null,"files":null,"tree":[],"storefront":"/r/feliperalmeida","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/feliperalmeida/django-modern-csrf/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}