Apr 14, 2026
datasette PR #2689: Replace token-based CSRF with Sec-Fetch-Site header protection · Simon Willison's Weblog
Science, Technology & Innovation · Apr 14, 2026
Datasette’s CSRF redesign removes hidden csrftoken fields from templates by moving CSRF protection into middleware based on request metadata, simplifying form authoring and maintenance while requiring operators to consult upgrade/compatibility guidance.
datasette PR #2689: Replace token-based CSRF with Sec-Fetch-Site header protection · Simon Willison's Weblog
Science, Technology & Innovation · Apr 14, 2026
Datasette replaced its per-request CSRF token system (asgi-csrf/hidden form fields) with middleware that validates the browser’s Sec-Fetch-Site header—inspired by Go 1.25 and Filippo Valsorda’s 2025 research—removing template token management and API carve-outs and shifting CSRF protection to header-based validation.
datasette PR #2689: Replace token-based CSRF with Sec-Fetch-Site header protection · Simon Willison's Weblog
Science, Technology & Innovation · Apr 14, 2026
A hybrid human-AI workflow had Claude Code generate most of a ten‑commit infra/security change (affecting request validation) with GPT‑5.4 cross‑review, while the maintainer wrote the PR description himself to preserve oversight, auditability, and intellectual honesty—showing AI can support production security‑adjacent refactors but governance should retain human-written summaries and explicit review.
datasette PR #2689: Replace token-based CSRF with Sec-Fetch-Site header protection · Simon Willison's Weblog
Science, Technology & Innovation · Apr 14, 2026
Datasette removed the plugin-level skip_csrf hook and moved CSRF handling to a centralized middleware model, requiring plugin authors to migrate and shifting security control into core to reduce policy fragmentation.