Implement CSRF (Cross Site Request Forgery) protection

[m4tx]

[eibrahim95]

@m4tx This would be done as a middleware, right?

[m4tx]

@eibrahim95 yes, I think so—blocking mutable requests that do not have the CSRF token should be the default behavior, which should be the most easily implementable as a middleware.

I believe we should have a similar solution to what Django has: https://docs.djangoproject.com/en/5.2/ref/csrf/#how-it-works

As usual with security issues, OWASP cheatsheet should be very useful as well: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html