datasette-auth-tokens could switch to using asgi_wrapper instead of actor_from_request - then it could add a scope["skip_csrf"] = True scope property to indicate that CSRF should not be protected.

Since asgi_wrapper wraps the CSRF protection middleware changes made to the scope by an asgi_wrapper will be visible to the CSRF middleware:

Lines 877 to 888 in d2aef9f

    
           asgi = AsgiLifespan( 
        
               AsgiTracer( 
        
                   asgi_csrf.asgi_csrf( 
        
                       DatasetteRouter(self, routes), 
        
                       signing_secret=self._secret, 
        
                       cookie_name="ds_csrftoken", 
        
                   ) 
        
               ), 
        
               on_startup=setup_db, 
        
           ) 
        
           for wrapper in pm.hook.asgi_wrapper(datasette=self): 
        
               asgi = wrapper(asgi)

	asgi = AsgiLifespan(
	AsgiTracer(
	asgi_csrf.asgi_csrf(
	DatasetteRouter(self, routes),
	signing_secret=self._secret,
	cookie_name="ds_csrftoken",
	)
	),
	on_startup=setup_db,
	)
	for wrapper in pm.hook.asgi_wrapper(datasette=self):
	asgi = wrapper(asgi)

Uh oh!

Mechanism for skipping CSRF checks on API posts #835

Description

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions