Security & Environment

Albedo includes modern security and environment management out of the box so you can focus on building your application safely.

Automatic CSRF Protection

Albedo natively implements the Double Submit Cookie pattern to protect your application from Cross-Site Request Forgery (CSRF).

On every GET request, Albedo automatically generates a secure token and passes it to your Jinja template context as {{ csrf_token }}. To protect your forms, simply add a hidden input field:

<form method="POST" action="/settings">
    <!-- Albedo will automatically validate this on submission -->
    <input type="hidden" name="csrf_token" value="{{ csrf_token }}">

    <label for="username">Username:</label>
    <input type="text" name="username">
    <button type="submit">Save</button>
</form>

If a POST request is submitted without this token, or if the token doesn't match the user's secure cookie, Albedo will intercept the request and return a 403 Forbidden error before your logic executes.

Auto-Loading Environment Variables

There is no need to manually export secrets in your terminal. Albedo automatically scaffolds .env and .env.example files when you initialize a project.

Because Albedo injects python-dotenv at the very top of your main.py, you can safely use standard Python environment variables anywhere in your app:

import os

# Safely loaded from your .env file
API_KEY = os.environ.get("EXTERNAL_API_KEY")