A way to enable CSRF protection without requiring an authentication handler

[way-dave]

Disabling CSRF protection in APIs by default seems extremely dangerous to me, since you have to read the documentation to figure it out. In general I'd much prefer security features defaulted to on rather than off. Particularly given users familiar with Django's built-in CSRF protection would not assume a framework-wide disabling of that protection!

But that would be a breaking change for ninja, so instead, it would be great to have a csrf_exempt parameter for NinjaAPI that defaults to True (for backwards compatibility). This would directly correspond to the csrf_exempt flag that is currently set on the view wrappers by ninja, allowing developers to re-enable the standard Django CSRF protection.

Otherwise, there's no clear way to re-enable CSRF protection without adding a cookie-based auth handler, which isn't appropriate for app apps.

[vitalik]

@way-dave - CSRF is not disabled by default - it's enabled automaticaly only for authentication methods that can have this voulnorability (like Cookie based / Session based auth)

All the other methods (basically any that do not store state in browsers are safe)

[way-dave]

The cookie-based authentication methods are not enabled by default, so to me, that means CSRF is disabled by default. 🤷

Either way, here's what happened in an app I maintain:

1. We have a django app with it's own custom middleware-based authentication (uses cookies).
2. We integrate django-ninja and grandually transition our API routes over to it.
3. We discover 6 months later that all the new routes are vulnerable to CSRF.

This was quite a scary side-effect to discover. Worse, it's not really obvious how to fix this.

[vitalik]

@way-dave

The cookie-based authentication methods are not enabled by default, so to me, that means CSRF is disabled by default.

what I mean here - cookie based - means you authentication is inherited from APIKeyCookie

class YourCustomAuthentication(APIKeyCookie):
    def authenticate(self, request, key):
        your logic

that way OpenAPI spec will reflect the reality of your logic and you will have csrf validation

[way-dave]

I understand the intent of only enabling CSRF protection if a cookie-based authentication scheme is used.

The trouble here that it's not compatible with more conventional authentication handled at the middleware layer in a django app that mixes a django-ninja API with other views. Implementing a "dummy" authentication handler just to convince django-ninja to apply CSRF protection seems pretty hacky.

I see a major advantage of django-ninja being it's ability to interop with other views in a Django application. This undermines that ability.

[vitalik]

@way-dave well if you rely on some other system that is not OpenAPI compatible - you can always just enable global crsf decorator

api = NinjaAPI(auth=unrotodox_auth)
api.add_decorator(csrf_protect) # !

[way-dave]

That is actually a great idea, thank you!