Built-in Middleware

from chirp.middleware import CORSMiddleware, CORSConfig

cors = CORSMiddleware(CORSConfig(
    allow_origins=["https://example.com"],
    allow_methods=["GET", "POST", "DELETE"],
    allow_headers=["HX-Request", "HX-Target"],
    allow_credentials=True,
    max_age=3600,
))

app.add_middleware(cors)

from chirp.middleware import StaticFiles

app.add_middleware(StaticFiles(
    directory="static",
    prefix="/static",
))

# Serve a full static site from the "public" directory
app.add_middleware(StaticFiles(
    directory="public",
    prefix="/",
    fallback="404.html",
))

from chirp.middleware.sessions import SessionConfig, SessionMiddleware

app.add_middleware(SessionMiddleware(SessionConfig(
    secret_key="change-me-in-production",
)))

from chirp.middleware.sessions import get_session

@app.route("/count")
def count():
    session = get_session()
    session["visits"] = session.get("visits", 0) + 1
    return f"Visits: {session['visits']}"

from chirp.middleware.sessions import SessionConfig, SessionMiddleware
from chirp.middleware.auth import AuthConfig, AuthMiddleware

app.add_middleware(SessionMiddleware(SessionConfig(secret_key="...")))
app.add_middleware(AuthMiddleware(AuthConfig(
    load_user=my_load_user,       # async (id: str) -> User | None
    verify_token=my_verify_token,  # async (token: str) -> User | None
)))

from dataclasses import dataclass

@dataclass(frozen=True, slots=True)
class User:
    id: str
    name: str
    is_authenticated: bool = True

@dataclass(frozen=True, slots=True)
class User:
    id: str
    name: str
    is_authenticated: bool = True
    permissions: frozenset[str] = frozenset()

from chirp import login, logout, Redirect

@app.route("/login", methods=["POST"])
async def do_login(request: Request):
    form = await request.form()
    user = await verify_credentials(form["username"], form["password"])
    if user:
        login(user)
        return Redirect("/dashboard")
    return Template("login.html", error="Invalid credentials")

@app.route("/logout", methods=["POST"])
def do_logout():
    logout()
    return Redirect("/")

from chirp import login_required, requires, get_user

@app.route("/dashboard")
@login_required
def dashboard():
    user = get_user()
    return Template("dashboard.html", user=user)

@app.route("/admin")
@requires("admin")
def admin_panel():
    return Template("admin.html")

def owner_policy(user, request):
    return request.query.get("owner_id") == user.id

@app.route("/docs/{doc_id}")
@requires("editor", policy=owner_policy)
def edit_doc(doc_id: str):
    ...

from chirp import is_safe_url, Redirect

@app.route("/login", methods=["POST"])
async def do_login(request: Request):
    # ... verify credentials ...
    login(user)
    next_url = request.query.get("next", "/dashboard")
    if not is_safe_url(next_url):
        next_url = "/dashboard"
    return Redirect(next_url)

{% if current_user().is_authenticated %}
    <a href="/profile">{{ current_user().name }}</a>
{% else %}
    <a href="/login">Sign in</a>
{% endif %}

from chirp.security.passwords import hash_password, verify_password

hashed = hash_password("user-password")      # Store this
ok = verify_password("user-password", hashed) # Check on login

from chirp.middleware import CSRFMiddleware

app.add_middleware(CSRFMiddleware())

<form method="post" action="/submit">
  {{ csrf_field() }}
  <!-- form fields -->
  <button type="submit">Submit</button>
</form>

from chirp.middleware import AuthRateLimitConfig, AuthRateLimitMiddleware

app.add_middleware(AuthRateLimitMiddleware(AuthRateLimitConfig(
    requests=10,
    window_seconds=60,
    block_seconds=300,
    paths=("/login", "/password-reset"),
)))

from chirp.middleware import SecurityHeadersMiddleware

app.add_middleware(SecurityHeadersMiddleware())

from chirp.middleware.security_headers import (
    SecurityHeadersConfig,
    SecurityHeadersMiddleware,
)

app.add_middleware(SecurityHeadersMiddleware(SecurityHeadersConfig(
    x_frame_options="SAMEORIGIN",
)))

from chirp.middleware.allowed_hosts import AllowedHostsMiddleware

app.add_middleware(AllowedHostsMiddleware(
    ("example.com", ".example.com"),
))

from chirp.middleware.csp_nonce import CSPNonceMiddleware

app.add_middleware(CSPNonceMiddleware())

<script nonce="{{ csp_nonce() }}">
    // Inline script allowed by CSP
</script>

from chirp.middleware.csp_nonce import get_csp_nonce

@app.route("/page")
def page():
    nonce = get_csp_nonce()
    return Template("page.html", nonce=nonce)

app.add_middleware(CSPNonceMiddleware(
    base_csp="default-src 'self'; img-src 'self' https://cdn.example.com"
))

from chirp.middleware import HTMLInject

# Inject live-reload script in development
app.add_middleware(HTMLInject(
    '<script src="/_dev/reload.js"></script>'
))