Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use secure and httponly csrf cookie #284

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Use secure and httponly csrf cookie #284

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ab10d3c
use secure and httponly csrf cookie
Astra-X May 16, 2024
6cdf3a5
add procution param for secure csrf cookie
May 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions piccolo_api/csrf/middleware.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,7 @@ def __init__(
cookie_name: str = DEFAULT_COOKIE_NAME,
header_name: str = DEFAULT_HEADER_NAME,
max_age: int = ONE_YEAR,
production: bool = False,
allow_header_param: bool = True,
allow_form_param: bool = False,
**kwargs,
Expand All @@ -65,6 +66,8 @@ def __init__(
different HTTP header.
:param max_age:
The max age of the cookie, in seconds.
:param production:
Whether the CSRF cookie should be secure.
:param allow_header_param:
Whether to look for the CSRF token in the HTTP headers.
:param allow_form_param:
Expand All @@ -81,6 +84,7 @@ def __init__(
self.cookie_name = cookie_name
self.header_name = header_name
self.max_age = max_age
self.production = production
self.allow_header_param = allow_header_param
self.allow_form_param = allow_form_param
super().__init__(app, **kwargs)
Expand Down Expand Up @@ -120,6 +124,7 @@ async def dispatch(
self.cookie_name,
token,
max_age=self.max_age,
secure=self.production,
)
return response
else:
Expand Down