def _needs_check_xsrf(handler):
    """Does the given cookie-authenticated request need to check xsrf?"""

    if getattr(handler, "_token_authenticated", False):
        return False

    fetch_mode = handler.request.headers.get("Sec-Fetch-Mode", "unspecified")
    if fetch_mode in {"websocket", "no-cors"} or (
        fetch_mode in {"navigate", "unspecified"}
        and handler.request.method.lower() in {"get", "head", "options"}
    ):
        # no xsrf check needed for regular page views or no-cors
        # or websockets after allow_websocket_cookie_auth passes
        if fetch_mode == "unspecified":
            app_log.warning(
                f"Skipping XSRF check for insecure request {handler.request.method} {handler.request.path}"
            )
        return False
    else:
        return True
Does the given cookie-authenticated request need to check xsrf?
jupyterhub/_xsrf_utils.py