19 lines
621 B
Python
19 lines
621 B
Python
import hmac
|
|
import secrets
|
|
|
|
from fastapi import HTTPException, Request, status
|
|
|
|
|
|
def ensure_csrf_token(request: Request) -> str:
|
|
token = request.session.get("csrf_token")
|
|
if not isinstance(token, str):
|
|
token = secrets.token_urlsafe(32)
|
|
request.session["csrf_token"] = token
|
|
return token
|
|
|
|
|
|
def validate_csrf(request: Request, submitted_token: str) -> None:
|
|
expected = request.session.get("csrf_token")
|
|
if not isinstance(expected, str) or not hmac.compare_digest(expected, submitted_token):
|
|
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Invalid CSRF token")
|