Back to feed

datasette PR #2689: Replace token-based CSRF with Sec-Fetch-Site header protection

Simon Willison's Weblog

Apr 14, 2026

4/14/2026

CSRF Redesign Moves Token Protection To Middleware And Removes Hidden Template Fields

datasette PR #2689: Replace token-based CSRF with Sec-Fetch-Site header protection · Simon Willison's Weblog

Science, Technology & Innovation · Apr 14, 2026

Datasette’s CSRF redesign removes hidden csrftoken fields from templates by moving CSRF protection into middleware based on request metadata, simplifying form authoring and maintenance while requiring operators to consult upgrade/compatibility guidance.


4/14/2026

Datasette Migrates From Token Based CSRF Protection To Browser Header Based Middleware

datasette PR #2689: Replace token-based CSRF with Sec-Fetch-Site header protection · Simon Willison's Weblog

Science, Technology & Innovation · Apr 14, 2026

Datasette replaced its per-request CSRF token system (asgi-csrf/hidden form fields) with middleware that validates the browser’s Sec-Fetch-Site header—inspired by Go 1.25 and Filippo Valsorda’s 2025 research—removing template token management and API carve-outs and shifting CSRF protection to header-based validation.


4/14/2026

AI-Assisted Development With Human Oversight For Auditability In Security Refactors

datasette PR #2689: Replace token-based CSRF with Sec-Fetch-Site header protection · Simon Willison's Weblog

Science, Technology & Innovation · Apr 14, 2026

A hybrid human-AI workflow had Claude Code generate most of a ten‑commit infra/security change (affecting request validation) with GPT‑5.4 cross‑review, while the maintainer wrote the PR description himself to preserve oversight, auditability, and intellectual honesty—showing AI can support production security‑adjacent refactors but governance should retain human-written summaries and explicit review.


4/14/2026

Datasette Removes Plugin CSRF Bypass Hook For Centralized Middleware Security

datasette PR #2689: Replace token-based CSRF with Sec-Fetch-Site header protection · Simon Willison's Weblog

Science, Technology & Innovation · Apr 14, 2026

Datasette removed the plugin-level skip_csrf hook and moved CSRF handling to a centralized middleware model, requiring plugin authors to migrate and shifting security control into core to reduce policy fragmentation.