I am building a FastAPI app serving Jinja2 templates and am a bit unsure on how to handle CSRF tokens. I have added Starlette's SessionMiddleware: app.add_middleware(SessionMiddleware, secret_key="some-random-string") However, I dont think I am using this correctly. My flow has been: make a secret string (the token), save in session pass down string to jinja templates as context variable include this string as header in POST requests middleware in API to check for header matches string in session I am aware of third party libraries but they don't seem to do much more than I have done. As the documentation (at least that I have read) don't specifically mention passing down the value to jinja templates I am unsure if it is handled automatically (wishful thinking). Could someone please provide guidance on the best practice or correct way to do this? Thank you Continue reading...
