Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

{{ csrftoken() }} doesn't work with datasette.render_template() #863

Closed
simonw opened this issue Jun 24, 2020 · 0 comments
Closed

{{ csrftoken() }} doesn't work with datasette.render_template() #863

simonw opened this issue Jun 24, 2020 · 0 comments

Comments

@simonw
Copy link
Owner

simonw commented Jun 24, 2020

The documentation here suggests that it will work:

Datasette uses `asgi-csrf <https://github.com/simonw/asgi-csrf>`__ to guard against CSRF attacks on form POST submissions. Users receive a ``ds_csrftoken`` cookie which is compared against the ``csrftoken`` form field (or ``x-csrftoken`` HTTP header) for every incoming request.
If your plugin implements a ``<form method="POST">`` anywhere you will need to include that token. You can do so with the following template snippet:
.. code-block:: html
<input type="hidden" name="csrftoken" value="{{ csrftoken() }}">

But right now the csrftoken variable is set in BaseView.render, which means it's not visible to plugins that try to render templates using datasette.render_template:

async def render(self, templates, request, context=None):
context = context or {}
template = self.ds.jinja_env.select_template(templates)
template_context = {
**context,
**{
"database_url": self.database_url,
"csrftoken": request.scope["csrftoken"],

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant