Callback for skipping checks about asgi-csrf HOT 8 CLOSED

Tricky thing is how this should interact with always_protect={set of paths}.

from asgi-csrf.

always_protect= solves a different case: it lets you specify that certain paths such as /login should ALWAYS be CSRF-protected even if they would not be otherwise (in that case to avoid login CSRF).

from asgi-csrf.

Relevant code (this is the only place that deals with always_protect at the moment):

from asgi-csrf.

Maybe I'll go with skip_protection=lambda scope: ... instead. That makes it a bit more clear what this optional mechanism is intended to do.

Potential names for that keyword argument:

• skip_protection=lambda scope: ..
• skip_protection_if=lambda scope: ..
• skip_protection_callback=lambda scope: ..
• skip_callback=
• skip_if_scope=
• skip_protection_if_scope=

from asgi-csrf.

I wish always_protect= was called always_protect_paths=.

from asgi-csrf.

skip_callback= is shorter, but is it as clear?

from asgi-csrf.

I quite like skip_if_scope=.

from asgi-csrf.

I've been using this successfully in Datasette plugins for a while now.

from asgi-csrf.