from gavel import app
import gavel.utils as utils
from flask import abort, request, session

@app.before_request
def csrf_protect():
    if request.method == "POST":
        token = session.pop('_csrf_token', None)
        if not token or token != request.form.get('_csrf_token'):
            abort(403)

def generate_csrf_token():
    if '_csrf_token' not in session:
        session['_csrf_token'] = utils.gen_secret(32)
    return session['_csrf_token']

app.jinja_env.globals['csrf_token'] = generate_csrf_token

from gavel import app
import gavel.utils as utils
from flask import abort, request, session

@app.before_request
def csrf_protect():
    if request.method == "POST":
        token = session.get('_csrf_token', None)
        if not token or token != request.form.get('_csrf_token'):
            abort(403)

def generate_csrf_token():
    if '_csrf_token' not in session:
        session['_csrf_token'] = utils.gen_secret(32)
    return session['_csrf_token']

app.jinja_env.globals['csrf_token'] = generate_csrf_token

Switch CSRF token from per-request to per-session
Switch CSRF token from per-request to per-session

This patch switches the CSRF token handling from per-request to
per-session. The per-request behavior was overly aggressive, and it
restricted parallel browsing (e.g. multiple open browser tabs).
