contracts.rules_safety

Page actions AI-ready formats and sharing
Open LLM text
Share with AI
Ask Claude Ask ChatGPT Ask Gemini Ask Copilot
module

Safety contract checks — catch silent failures that app.check() previously missed.

Categories:

  • sse_speculation: SSE/streaming routes without speculation exclusion
  • csrf_session: CSRFMiddleware without SessionMiddleware
  • middleware_signature: Middleware with wrong call signature

Safety contract checks — catch silent failures that app.check() previously missed.

Categories:

  • sse_speculation: SSE/streaming routes without speculation exclusion
  • csrf_session: CSRFMiddleware without SessionMiddleware
  • middleware_signature: Middleware with wrong call signature

contracts.rules_safety

Name Type Default Description
type —
qualified_name —
element_type —
description —
source_file —
line_number —
is_autodoc —
autodoc_element —
_autodoc_template —
_autodoc_url_path —
_autodoc_page_type —
title —
doc_content_hash —

Symbols on this page

function check_sse_speculation

Warn when SSE/streaming routes lackreferenced=True.

SSE endpoints included in browser speculation rules cause silent prefetch connections that hang. Routes whose handler source…

Jump to symbol function check_csrf_session_order

Error when CSRFMiddleware is registered without SessionMiddleware.

CSRF tokens are stored in the session. If SessionMiddleware is missing or ordered after CSRFMiddleware, CSRF validation…

Jump to symbol function check_middleware_signatures

Warn when middleware has a__call__signature that won't work.

Chirp middleware must be async callables accepting(request, next)and returning a response. Wrong…

Jump to symbol function check_secret_key

Error when secret_key is empty in non-development environments.

Sessions and CSRF tokens are signed with the secret key. An empty key provides no security…

Jump to symbol function check_allowed_hosts

Warn/error when host validation is permissive outside development.

Jump to symbol function check_trusted_proxies

Warn when trusted_proxies trusts every reverse-proxy peer outside development.

trusted_proxies gates whether X-Forwarded-For is honored. "*"trusts every direct peer's forwarded headers, which lets…

Jump to symbol
check_sse_speculation
function 
def check_sse_speculation(router: Router) -> list[ContractIssue]

Warn when SSE/streaming routes lackreferenced=True.

SSE endpoints included in browser speculation rules cause silent prefetch connections that hang. Routes whose handler source contains EventStream or reactive_stream should set referenced=True to be excluded from speculation.

Parameters

Name Type Default Description
router Router —
check_csrf_session_order
function 
def check_csrf_session_order(middleware_list: list[Any]) -> list[ContractIssue]

Error when CSRFMiddleware is registered without SessionMiddleware.

CSRF tokens are stored in the session. If SessionMiddleware is missing or ordered after CSRFMiddleware, CSRF validation will fail at request time with a confusing error.

Parameters

Name Type Default Description
middleware_list list[Any] —
check_middleware_signatures
function 
def check_middleware_signatures(middleware_list: list[Any]) -> list[ContractIssue]

Warn when middleware has a__call__signature that won't work.

Chirp middleware must be async callables accepting(request, next) and returning a response. Wrong signatures crash at request time with confusing tracebacks.

Parameters

Name Type Default Description
middleware_list list[Any] —
check_secret_key
function 
def check_secret_key(config: Any) -> list[ContractIssue]

Error when secret_key is empty in non-development environments.

Sessions and CSRF tokens are signed with the secret key. An empty key provides no security — anyone can forge tokens.

Parameters

Name Type Default Description
config Any —
check_allowed_hosts
function 
def check_allowed_hosts(config: Any) -> list[ContractIssue]

Warn/error when host validation is permissive outside development.

Parameters

Name Type Default Description
config Any —
check_trusted_proxies
function 
def check_trusted_proxies(config: Any) -> list[ContractIssue]

Warn when trusted_proxies trusts every reverse-proxy peer outside development.

trusted_proxies gates whether X-Forwarded-For is honored. "*"trusts every direct peer's forwarded headers, which lets any client spoof its client IP (defeating per-IP rate limiting and audit/access correlation). Always WARNING (never promoted to ERROR) — silent in development, fires for staging and production.

Parameters

Name Type Default Description
config Any —

View source · /home/runner/work/chirp/chirp/site/../src/chirp/contracts/rules_safety.py:1