You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Datasette uses `asgi-csrf <https://github.com/simonw/asgi-csrf>`__ to guard against CSRF attacks on form POST submissions. Users receive a ``ds_csrftoken`` cookie which is compared against the ``csrftoken`` form field (or ``x-csrftoken`` HTTP header) for every incoming request.
If your plugin implements a ``<form method="POST">`` anywhere you will need to include that token. You can do so with the following template snippet:
But right now the csrftoken variable is set in BaseView.render, which means it's not visible to plugins that try to render templates using datasette.render_template:
The documentation here suggests that it will work:
datasette/docs/internals.rst
Lines 540 to 546 in eed116a
But right now the
csrftoken
variable is set in BaseView.render, which means it's not visible to plugins that try to render templates usingdatasette.render_template
:datasette/datasette/views/base.py
Lines 99 to 106 in 799c5d5
The text was updated successfully, but these errors were encountered: