CSRF Token in state (for display only): {token}
\n \n \n \n \n '''\n\n@app.post(\"/submit\")\nasync def submit_item(item: str = Form(...), response: Response = None):\n # The middleware automatically validates the token from the 'x-csrftoken' header\n # If validation fails, it returns a 403 Forbidden before this handler is called.\n return {\"message\": f\"Item '{item}' received successfully!\"}\n\nif __name__ == \"__main__\":\n # To run: uvicorn your_app_file_name:app --reload\n # Then open http://127.0.0.1:8000\n uvicorn.run(app, host=\"127.0.0.1\", port=8000)\n","lang":"python","description":"This quickstart demonstrates how to integrate `CSRFMiddleware` into a FastAPI application. A `GET` request will automatically receive a `csrftoken` cookie and expose the token in `request.state.csrftoken`. For `POST` requests, the client is expected to include this token in an `x-csrftoken` header for successful validation. The example shows how to embed this in an HTML form."},"warnings":[{"fix":"Upgrade Python to 3.8 or newer. If unable to upgrade Python, pin `starlette-csrf` to `<3.0.0`.","message":"Version 3.0.0 dropped support for Python 3.7. Users on older Python versions must upgrade or remain on `starlette-csrf<3.0.0`.","severity":"breaking","affected_versions":">=3.0.0"},{"fix":"Ensure all optional arguments to `CSRFMiddleware` (e.g., `exempt_urls`, `cookie_name`) are passed as keyword arguments, not positional. Standard usage via `app.add_middleware` or `Middleware()` is generally unaffected.","message":"Starting with version 2.0.0, middleware initializer arguments (other than `app` and `secret`) became keyword-only. While this primarily affects direct instantiation, it's a breaking change for custom middleware setups.","severity":"breaking","affected_versions":">=2.0.0"},{"fix":"If you have custom middleware extending `CSRFMiddleware`, review your implementation for compatibility with the pure ASGI interface. For standard usage, no action is required.","message":"Version 1.4.4 rewrote the middleware as a pure ASGI middleware, moving away from `starlette.middleware.base.BaseHTTPMiddleware` (which is now deprecated in Starlette). While an improvement, this might affect advanced users who previously extended `CSRFMiddleware` and relied on `BaseHTTPMiddleware`'s internal structure or methods.","severity":"gotcha","affected_versions":">=1.4.4"}],"env_vars":null,"last_verified":"2026-04-16T00:00:00.000Z","next_check":"2026-07-15T00:00:00.000Z","problems":[{"fix":"Ensure your frontend (HTML form or JavaScript AJAX request) correctly retrieves the `csrftoken` cookie value and sends it in the `x-csrftoken` HTTP header for all unsafe requests (POST, PUT, DELETE, PATCH). For HTML forms, you can inject `request.state.csrftoken` into a hidden input field. For AJAX, read the cookie and set the header manually.","cause":"The CSRF token expected in the 'x-csrftoken' header (or the configured header name) does not match the token in the 'csrftoken' cookie, or the header is missing entirely.","error":"403 Forbidden error on POST requests (or other unsafe methods)."},{"fix":"Exempt WebSocket routes from CSRF protection by adding them to the `exempt_urls` argument of the `CSRFMiddleware` using a regular expression pattern. Alternatively, wrap the middleware to conditionally apply it only to HTTP scopes, as suggested in some community discussions.","cause":"The `CSRFMiddleware` is designed for HTTP requests and may not handle WebSocket scopes correctly, leading to internal errors if it processes a WebSocket connection.","error":"WebSocket connections fail with `AssertionError` or other unexpected errors when `CSRFMiddleware` is applied globally."}]}