Always generate a token even if scope not called

[frankie567]

Hello 👋

Thank you for this very useful middleware!

I have a use case (see fastapi-users/fastapi-users#291) where I call an API through the browser, using Cookie authentication. Thus, CSRF protection would be beneficial. However, it's a pure API : it doesn't generate any template ; so I don't have the opportunity to call request.scope.csrftoken() to generate the token.

Would it be possible (and sensible!) to have an option in the middleware to allow a token to be generated even if request.scope.csrftoken() is not called in the route logic?

Best regards!

[simonw]

This makes sense to me as an opt-in option.

[simonw]

Documentation: https://github.com/simonw/asgi-csrf/blob/0.8/README.md#always-setting-the-cookie-if-it-is-not-already-set

[frankie567]

Thank you @simonw, that will greatly help 👍