Georges-Antoine Assi be476cb7dc Only set CSRF cookie on http.response.start ...

ASGI spec only allows headers on the http.response.start message;
appending Set-Cookie to body messages is out-of-spec and may break on
some servers. Early-return for non-start messages.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-24 15:46:50 -04:00

..

csrf_middleware.py

Only set CSRF cookie on http.response.start

2026-05-24 15:46:50 -04:00

redis_session_middleware.py

changes from bot review

2025-11-22 11:22:45 -05:00

session_middleware.py

implement csrf middleware directly in repo

2025-11-17 21:12:29 -05:00