Middleware — Protocol-based, no inheritance required.
A middleware is any callable matching:
async def mw(request: Request, next: Next) -> Response
Built-in middleware: AuditMiddleware -- Opt-in per-request who/what/when/status audit trail over the existing security-event sink (off by default; downgrades to metadata-only for streaming/SSE responses). AuthMiddleware -- Dual-mode authentication (session + token) AuthRateLimitMiddleware -- Keyed rate limiting (auth endpoints by default; any route/group via key_fn + open paths). Pluggable storage via the RateLimitBackend Protocol; redis_rate_limit_backend builds a Redis-backed sliding window. Set error_template/error_block for an HTML 429 on htmx form-action POSTs. CORSMiddleware -- Cross-Origin Resource Sharing CSRFMiddleware -- CSRF token protection (requires SessionMiddleware) HTMLInject -- Inject snippets into HTML responses SecurityHeadersMiddleware -- X-Frame-Options, X-Content-Type-Options, Referrer-Policy SessionMiddleware -- Signed cookie sessions (requires itsdangerous) StaticFiles -- Serve static files from a directory
middleware
| Name | Type | Default | Description |
|---|---|---|---|
type
|
|
— | |
qualified_name
|
|
— | |
element_type
|
|
— | |
description
|
|
— | |
source_file
|
|
— | |
line_number
|
|
— | |
is_autodoc
|
|
— | |
autodoc_element
|
|
— | |
_autodoc_template
|
|
— | |
_autodoc_url_path
|
|
— | |
_autodoc_page_type
|
|
— | |
title
|
|
— | |
doc_content_hash
|
|
— |
View source · /home/runner/work/chirp/chirp/site/../src/chirp/middleware/__init__.py:1