remote/datasette
1
0
Fork 0
mirror of https://github.com/simonw/datasette.git synced 2026-09-04 07:34:15 +02:00
Code Issues Projects Releases Packages Wiki Activity
3,408 commits 192 branches 179 tags 334 MiB
Commit graph

4 commits

Author SHA1 Message Date
Simon Willison
e889403d3b
 		Upgrade to ruff>=0.16.0 (#2857) 
* ruff>=0.16.0

See https://astral.sh/blog/ruff-v0.16.0

* uv run ruff check . --fix --unsafe-fixes

* Ruff fixes by Claude Code Opus 5
 2026-07-25 15:47:08 -07:00
Simon Willison
a973e3ffa1 Normalize headers in CSRF checks, refs #2689 2026-04-14 19:24:38 -07:00
Simon Willison
028cc2446f Don't allow cookies with Authorization: Bearer to bypass CSRF 
Refs #2689
 2026-04-14 19:23:21 -07:00
Simon Willison
0b639a8122
 		Replace token-based CSRF with Sec-Fetch-Site header protection (#2689) 
- New CSRF protection middleware inspired by Go 1.25 and research by Filippo Valsorda - https://words.filippo.io/csrf/ - this replaces the old CSRF token based protection.
- Removes all instances of `<input type="hidden" name="csrftoken" value="{{ csrftoken() }}">` in the templates - they are no longer needed.
- Removes the `def skip_csrf(datasette, scope):` plugin hook defined in `datasette/hookspecs.py` and its documentation and tests.
- Updated CSRF protection documentation to describe the new approach.
- Upgrade guide now describes the CSRF change.
 2026-04-14 17:11:36 -07:00