Method dispatch

apps/api/src/security/csrf.py:126–148

(self, request: Request, call_next: Callable)

        return False

    async def dispatch(self, request: Request, call_next: Callable) -> Response:
        # Only check state-changing methods
        if request.method not in STATE_CHANGING_METHODS:
            return await call_next(request)

        # Skip CSRF for requests using explicit auth (not cookie-based)
        if self._is_csrf_exempt(request):
            return await call_next(request)

        # Get origin and referer headers
        origin = request.headers.get("origin")
        referer = request.headers.get("referer")

        # Validate origin
        if not self.is_allowed_origin(origin, referer):
            return JSONResponse(
                status_code=403,
                content={
                    "detail": "CSRF validation failed: Origin not allowed"
                }
            )

        return await call_next(request)