AI BriefingCSRF header switch
Key point
Datasette has switched from CSRF tokens to Sec-Fetch-Site header-based protection.
Details
Datasette has moved from the existing CSRF token approach to Sec-Fetch-Site header-based protection. Simon Willison explained that this change was inspired by Filippo Valsorda's August 2025 research and its implementation in Go 1.25.
The previous approach required inserting <input type="hidden" name="csrftoken" value="{{ csrftoken() }}"> into every template, and needed exception handling for APIs called outside the browser, which was cumbersome. The new middleware removes this token-centric structure and blocks CSRF by determining whether a request is from a browser via headers.
According to the PR description, much of this change was done by Claude Code, spanning a total of 10 commits. Simon provided direct guidance, and GPT-5.4 handled the cross review.
The changes are as follows.
- Added new CSRF protection middleware
- Removed all
csrftokenhidden inputs - Deleted the
def skip_csrf(datasette, scope):plugin hook - Updated CSRF documentation and upgrade guide
- Cleaned up related tests and hook documentation
This summary was generated automatically by AI. Check the original for the author's claims and context. Copyright belongs to the original author.
Our guide explains how the AI works. Report summary errors, attribution issues, or removal requests via Contact.