v9.0.1

Responder 9.0.1

A bug-fix release from a post-9.0.0 adversarial scan. Several v9-new surfaces had crash or enforcement defects; upgrading from 9.0.0 is recommended, as some are security-relevant.

Fixed

• CSRF (security): the per-route csrf= override was stored on the shared view object, so re-registering a function with csrf=False stripped protection from its earlier routes, and a class-based view registered with csrf=False leaked the exemption to subclasses through the MRO. Each registration's value is now frozen onto its own route.
• CSRF: a non-ASCII submitted token (a client-controlled csrf_token field or X-CSRF-Token header) crashed hmac.compare_digest and returned 500 instead of 403.
• CSRF: csrf=True on a WebSocket route was accepted but never enforced; it now raises at registration.
• Proxy headers: a forwarded Host port (or Content-Length) that is a non-ASCII digit character crashed inside the outermost ProxyHeadersMiddleware, sending no response at all.
• Rate limiting: @limiter.limit on a class-based-view method returned 500 on every request.
• GraphQL: a non-object JSON body and a multipart POST without a query field both returned 500; both now return 400.
• Forms: a malformed or oversized multipart body on the buffered parse branch returned 500 instead of 400.
• OpenAPI: the generated-document cache ignored request_timeout and problem_details, serving a stale schema after either changed.

Full changelog: https://github.com/kennethreitz/responder/blob/main/CHANGELOG.md

---

📦 PyPI: https://pypi.org/project/responder/9.0.1/