def ValidateCSRFTokenOrRaise(request):
    'Decorator for WSGI handler that checks CSRF cookie against the request.'
    if (request.method in ('GET', 'HEAD')):
        return
    csrf_token = request.headers.get('X-CSRFToken', '').encode('ascii')
    if (not csrf_token):
        logging.info('Did not find headers CSRF token for: %s', request.path)
        raise werkzeug_exceptions.Forbidden('CSRF token is missing')
    try:
        decoded = base64.urlsafe_b64decode((csrf_token + b'=='))
        (digest, token_time) = decoded.rsplit(CSRF_DELIMITER, 1)
        token_time = int(token_time)
    except (TypeError, ValueError):
        logging.info('Malformed CSRF token for: %s', request.path)
        raise werkzeug_exceptions.Forbidden('Malformed CSRF token')
    if (len(digest) != hashlib.sha256().digest_size):
        logging.info('Invalid digest size for: %s', request.path)
        raise werkzeug_exceptions.Forbidden('Malformed CSRF token digest')
    expected = GenerateCSRFToken(request.user, token_time)
    if (not constant_time.bytes_eq(csrf_token, expected)):
        logging.info('Non-matching CSRF token for: %s', request.path)
        raise werkzeug_exceptions.Forbidden('Non-matching CSRF token')
    current_time = rdfvalue.RDFDatetime.Now().AsMicrosecondsSinceEpoch()
    if ((current_time - token_time) > CSRF_TOKEN_DURATION.microseconds):
        logging.info('Expired CSRF token for: %s', request.path)
        raise werkzeug_exceptions.Forbidden('Expired CSRF token')
Decorator for WSGI handler that checks CSRF cookie against the request.
def ValidateCSRFTokenOrRaise(request):
    
    if (request.method in ('GET', 'HEAD')):
        return
    csrf_token = request.headers.get('X-CSRFToken', ).encode('ascii')
    if (not csrf_token):
        logging.info('Did not find headers CSRF token for: %s', request.path)
        raise werkzeug_exceptions.Forbidden('CSRF token is missing')
    try:
        decoded = base64.urlsafe_b64decode((csrf_token + b'=='))
        (digest, token_time) = decoded.rsplit(CSRF_DELIMITER, 1)
        token_time = int(token_time)
    except (TypeError, ValueError):
        logging.info('Malformed CSRF token for: %s', request.path)
        raise werkzeug_exceptions.Forbidden('Malformed CSRF token')
    if (len(digest) != hashlib.sha256().digest_size):
        logging.info('Invalid digest size for: %s', request.path)
        raise werkzeug_exceptions.Forbidden('Malformed CSRF token digest')
    expected = GenerateCSRFToken(request.user, token_time)
    if (not constant_time.bytes_eq(csrf_token, expected)):
        logging.info('Non-matching CSRF token for: %s', request.path)
        raise werkzeug_exceptions.Forbidden('Non-matching CSRF token')
    current_time = rdfvalue.RDFDatetime.Now().AsMicrosecondsSinceEpoch()
    if ((current_time - token_time) > CSRF_TOKEN_DURATION.microseconds):
        logging.info('Expired CSRF token for: %s', request.path)
        raise werkzeug_exceptions.Forbidden('Expired CSRF token')