Add built-in CSRF protection using Sec-Fetch-Site header

[sharoonthomas]

Implements Option 2 from #5863.

Adds built-in CSRF protection using the Sec-Fetch-Site header that modern browsers send
automatically, with an Origin header fallback for older browsers.

Changes

• Add CSRF_PROTECTION, CSRF_TRUSTED_ORIGINS, and CSRF_PROTECTED_METHODS config options
• Add csrf_protection parameter to @app.route() and add_url_rule()
• Add csrf_protection attribute support for class-based views
• Check CSRF in full_dispatch_request() before preprocess_request()

Algorithm

1. Allow safe methods (GET, HEAD, OPTIONS)
2. Allow if origin is in CSRF_TRUSTED_ORIGINS
3. If Sec-Fetch-Site header present: allow same-origin/none, reject
   same-site/cross-site
4. If no browser headers present: allow (non-browser clients)
5. If Origin present: allow if it matches Host, otherwise reject

Usage

# Enable globally
app.config['CSRF_PROTECTION'] = True

# Enable per-route
@app.route('/api', methods=['POST'], csrf_protection=True)
def api():
    ...

# Exempt a route when enabled globally
@app.route('/webhook', methods=['POST'], csrf_protection=False)
def webhook():
    ...

fixes #5863

[davidism]

Are you using an LLM tool to substantially generate your writing or code?

[sharoonthomas]

Are you using an LLM tool to substantially generate your writing or code?

Used claude code with opus 4.5 (substantially for the test cases).

[sharoonthomas]

@ThiefMaster apologies if I've missed any contribution guidelines around tooling or process; happy to correct anything that's not aligned.

@davidism and @ThiefMaster If you have concerns about the implementation or approach itself, I'd genuinely like to hear them.

[davidism]

You didn't have time to understand or implement the feature, but you expect the maintainers to have that time to carefully review everything you asked an LLM to generate. That's not acceptable for anything, but especially for a security-related feature.

If I did want to use an AI, I have access to the same tools you do, so you saved me essentially no time at all in that case.