CSRF protection

[simonw]

Refs #793

[simonw]

Needs unit tests.

More importantly: needs very, very careful consideration of how this plays with HTTP caching.

[simonw]

I don't want to set a cookie on a page response that is being cached.

Right now the ASGI middleware will be doing exactly that, which is bad.

But how do I get certainty that when you load a page with a form that will be CSRF protected you have been served the cookie?

Maybe those pages should do something explicit to the request object indicating that the cookie is needed?

That works for Datasette (since it has mutable request objects) but I'm not sure how it would work in the asgi-csrf pure ASGI middleware context.

[simonw]

Django docs on CSRF and caching: https://docs.djangoproject.com/en/3.0/ref/csrf/#caching

If the csrf_token template tag is used by a template (or the get_token function is called some other way), CsrfViewMiddleware will add a cookie and a Vary: Cookie header to the response. This means that the middleware will play well with the cache middleware if it is used as instructed

So the cookie is only set for pages that included a hidden csrftoken form field! This could work.

[simonw]

I'm solving the compatibility with caching problem in this ticket: simonw/asgi-csrf#7

[simonw]

Add unit tests illustrating the Vary: Cookie header and I'm done here.