datasette PR #2689: Replace token-based CSRF with Sec-Fetch-Site header protection

# datasette PR #2689: Replace token-based CSRF with Sec-Fetch-Site header protection Source: https://simonwillison.net/2026/Apr/14/replace-token-based-csrf/ 14th April 2026 - Link Blog **datasette PR #2689: Replace token-based CSRF with Sec-Fetch-Site header protection (https://github.com/simonw/datasette/pull/2689)**. Datasette has long protected against CSRF attacks using CSRF tokens, implemented using my `asgi-csrf` (https://github.com/simonw/asgi-csrf) Python library. These are something of a pain to work with – you need to scatter forms in templates with `{{ csrf_token() }}` lines and then selectively disable CSRF protection for APIs that are intended to be called from outside the browser. I've been following Filippo Valsorda's research here with interest, described in this detailed essay from August 2025 (https://words.filippo.io/csrf/) and shipped as part of Go 1.25 (https://tip.golang.org/doc/go1.25#nethttppkgnethttp) that same month. I've now landed the same change in Datasette. Here's the PR description – Claude Code did much of the work (across 10 commits, closely guided by me and cross-reviewed by GPT-5.4) but I've decided to start writing these PR descriptions by hand, partly to make them more concise and also as an exercise in keeping myself honest. > - New CSRF protection middleware inspired by Go 1.25 and this research (https://words.filippo.io/csrf/) by Filippo Valsorda. This replaces the old CSRF token based protection. > - Removes all instances of `{{ csrf_token() }}` in the templates – they are no longer needed. > - Removes the `def skip_csrf(datasette, scope):` plugin hook defined in `datasette/hookspecs.py` and its documentation and tests. > - Updated CSRF protection documentation (https://docs.datasette.io/en/latest/internals.html#csrf-protection) to describe the new approach. > - Upgrade guide now describes the CSRF change (https://docs.datasette.io/en/latest/upgrade_guide.html#csrf-protection-is-now-header-based).