prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  CSRF token should be expire with session
  ### Apache Airflow version
  
  2.5.0
  
  ### What happened
  
  In the default configuration, the CSRF token [expires in one hour](https://pythonhosted.org/Flask-WTF/config.html#forms-and-csrf). This setting leads to frequent errors in the UI – for no good reason.
  
  
  ### What you think should happen instead
  
  A short expiration date for the CSRF token is not the right value in my view and I [agree with this answer](https://security.stackexchange.com/a/56520/22108) that the CSRF token should basically never expire, instead pegging itself to the current session.
  
  That is, the CSRF token should last as long as the current session. The easiest way to accomplish this is by generating the CSRF token from the session id.
  
  
  
  ### How to reproduce
  
  _No response_
  
  ### Operating System
  
  Linux
  
  ### Versions of Apache Airflow Providers
  
  _No response_
  
  ### Deployment
  
  Official Apache Airflow Helm Chart
  
  ### Deployment details
  
  _No response_
  
  ### Anything else
  
  _No response_
  
  ### Are you willing to submit PR?
  
  - [ ] Yes I am willing to submit a PR!
  
  ### Code of Conduct
  
  - [X] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
  
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `airflow/config_templates/default_webserver_config.py`
  Content:
  ```
  1 #
  2 # Licensed to the Apache Software Foundation (ASF) under one
  3 # or more contributor license agreements.  See the NOTICE file
  4 # distributed with this work for additional information
  5 # regarding copyright ownership.  The ASF licenses this file
  6 # to you under the Apache License, Version 2.0 (the
  7 # "License"); you may not use this file except in compliance
  8 # with the License.  You may obtain a copy of the License at
  9 #
  10 #   http://www.apache.org/licenses/LICENSE-2.0
  11 #
  12 # Unless required by applicable law or agreed to in writing,
  13 # software distributed under the License is distributed on an
  14 # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
  15 # KIND, either express or implied.  See the License for the
  16 # specific language governing permissions and limitations
  17 # under the License.
  18 """Default configuration for the Airflow webserver."""
  19 from __future__ import annotations
  20 
  21 import os
  22 
  23 from airflow.www.fab_security.manager import AUTH_DB
  24 
  25 # from airflow.www.fab_security.manager import AUTH_LDAP
  26 # from airflow.www.fab_security.manager import AUTH_OAUTH
  27 # from airflow.www.fab_security.manager import AUTH_OID
  28 # from airflow.www.fab_security.manager import AUTH_REMOTE_USER
  29 
  30 
  31 basedir = os.path.abspath(os.path.dirname(__file__))
  32 
  33 # Flask-WTF flag for CSRF
  34 WTF_CSRF_ENABLED = True
  35 
  36 # ----------------------------------------------------
  37 # AUTHENTICATION CONFIG
  38 # ----------------------------------------------------
  39 # For details on how to set up each of the following authentication, see
  40 # http://flask-appbuilder.readthedocs.io/en/latest/security.html# authentication-methods
  41 # for details.
  42 
  43 # The authentication type
  44 # AUTH_OID : Is for OpenID
  45 # AUTH_DB : Is for database
  46 # AUTH_LDAP : Is for LDAP
  47 # AUTH_REMOTE_USER : Is for using REMOTE_USER from web server
  48 # AUTH_OAUTH : Is for OAuth
  49 AUTH_TYPE = AUTH_DB
  50 
  51 # Uncomment to setup Full admin role name
  52 # AUTH_ROLE_ADMIN = 'Admin'
  53 
  54 # Uncomment and set to desired role to enable access without authentication
  55 # AUTH_ROLE_PUBLIC = 'Viewer'
  56 
  57 # Will allow user self registration
  58 # AUTH_USER_REGISTRATION = True
  59 
  60 # The recaptcha it's automatically enabled for user self registration is active and the keys are necessary
  61 # RECAPTCHA_PRIVATE_KEY = PRIVATE_KEY
  62 # RECAPTCHA_PUBLIC_KEY = PUBLIC_KEY
  63 
  64 # Config for Flask-Mail necessary for user self registration
  65 # MAIL_SERVER = 'smtp.gmail.com'
  66 # MAIL_USE_TLS = True
  67 # MAIL_USERNAME = 'yourappemail@gmail.com'
  68 # MAIL_PASSWORD = 'passwordformail'
  69 # MAIL_DEFAULT_SENDER = 'sender@gmail.com'
  70 
  71 # The default user self registration role
  72 # AUTH_USER_REGISTRATION_ROLE = "Public"
  73 
  74 # When using OAuth Auth, uncomment to setup provider(s) info
  75 # Google OAuth example:
  76 # OAUTH_PROVIDERS = [{
  77 #   'name':'google',
  78 #     'token_key':'access_token',
  79 #     'icon':'fa-google',
  80 #         'remote_app': {
  81 #             'api_base_url':'https://www.googleapis.com/oauth2/v2/',
  82 #             'client_kwargs':{
  83 #                 'scope': 'email profile'
  84 #             },
  85 #             'access_token_url':'https://accounts.google.com/o/oauth2/token',
  86 #             'authorize_url':'https://accounts.google.com/o/oauth2/auth',
  87 #             'request_token_url': None,
  88 #             'client_id': GOOGLE_KEY,
  89 #             'client_secret': GOOGLE_SECRET_KEY,
  90 #         }
  91 # }]
  92 
  93 # When using LDAP Auth, setup the ldap server
  94 # AUTH_LDAP_SERVER = "ldap://ldapserver.new"
  95 
  96 # When using OpenID Auth, uncomment to setup OpenID providers.
  97 # example for OpenID authentication
  98 # OPENID_PROVIDERS = [
  99 #    { 'name': 'Yahoo', 'url': 'https://me.yahoo.com' },
  100 #    { 'name': 'AOL', 'url': 'http://openid.aol.com/<username>' },
  101 #    { 'name': 'Flickr', 'url': 'http://www.flickr.com/<username>' },
  102 #    { 'name': 'MyOpenID', 'url': 'https://www.myopenid.com' }]
  103 
  104 # ----------------------------------------------------
  105 # Theme CONFIG
  106 # ----------------------------------------------------
  107 # Flask App Builder comes up with a number of predefined themes
  108 # that you can use for Apache Airflow.
  109 # http://flask-appbuilder.readthedocs.io/en/latest/customizing.html#changing-themes
  110 # Please make sure to remove "navbar_color" configuration from airflow.cfg
  111 # in order to fully utilize the theme. (or use that property in conjunction with theme)
  112 # APP_THEME = "bootstrap-theme.css"  # default bootstrap
  113 # APP_THEME = "amelia.css"
  114 # APP_THEME = "cerulean.css"
  115 # APP_THEME = "cosmo.css"
  116 # APP_THEME = "cyborg.css"
  117 # APP_THEME = "darkly.css"
  118 # APP_THEME = "flatly.css"
  119 # APP_THEME = "journal.css"
  120 # APP_THEME = "lumen.css"
  121 # APP_THEME = "paper.css"
  122 # APP_THEME = "readable.css"
  123 # APP_THEME = "sandstone.css"
  124 # APP_THEME = "simplex.css"
  125 # APP_THEME = "slate.css"
  126 # APP_THEME = "solar.css"
  127 # APP_THEME = "spacelab.css"
  128 # APP_THEME = "superhero.css"
  129 # APP_THEME = "united.css"
  130 # APP_THEME = "yeti.css"
  131
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/airflow/config_templates/default_webserver_config.py b/airflow/config_templates/default_webserver_config.py
  --- a/airflow/config_templates/default_webserver_config.py
  +++ b/airflow/config_templates/default_webserver_config.py
  @@ -32,6 +32,7 @@
   
   # Flask-WTF flag for CSRF
   WTF_CSRF_ENABLED = True
  +WTF_CSRF_TIME_LIMIT = None
   
   # ----------------------------------------------------
   # AUTHENTICATION CONFIG
  
verification_info: {"golden_diff": "diff --git a/airflow/config_templates/default_webserver_config.py b/airflow/config_templates/default_webserver_config.py\n--- a/airflow/config_templates/default_webserver_config.py\n+++ b/airflow/config_templates/default_webserver_config.py\n@@ -32,6 +32,7 @@\n \n # Flask-WTF flag for CSRF\n WTF_CSRF_ENABLED = True\n+WTF_CSRF_TIME_LIMIT = None\n \n # ----------------------------------------------------\n # AUTHENTICATION CONFIG\n", "issue": "CSRF token should be expire with session\n### Apache Airflow version\n\n2.5.0\n\n### What happened\n\nIn the default configuration, the CSRF token [expires in one hour](https://pythonhosted.org/Flask-WTF/config.html#forms-and-csrf). This setting leads to frequent errors in the UI \u2013 for no good reason.\r\n\n\n### What you think should happen instead\n\nA short expiration date for the CSRF token is not the right value in my view and I [agree with this answer](https://security.stackexchange.com/a/56520/22108) that the CSRF token should basically never expire, instead pegging itself to the current session.\r\n\r\nThat is, the CSRF token should last as long as the current session. The easiest way to accomplish this is by generating the CSRF token from the session id.\r\n\r\n\n\n### How to reproduce\n\n_No response_\n\n### Operating System\n\nLinux\n\n### Versions of Apache Airflow Providers\n\n_No response_\n\n### Deployment\n\nOfficial Apache Airflow Helm Chart\n\n### Deployment details\n\n_No response_\n\n### Anything else\n\n_No response_\n\n### Are you willing to submit PR?\n\n- [ ] Yes I am willing to submit a PR!\n\n### Code of Conduct\n\n- [X] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)\n\n", "before_files": [{"content": "#\n# Licensed to the Apache Software Foundation (ASF) under one\n# or more contributor license agreements.  See the NOTICE file\n# distributed with this work for additional information\n# regarding copyright ownership.  The ASF licenses this file\n# to you under the Apache License, Version 2.0 (the\n# \"License\"); you may not use this file except in compliance\n# with the License.  You may obtain a copy of the License at\n#\n#   http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing,\n# software distributed under the License is distributed on an\n# \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\n# KIND, either express or implied.  See the License for the\n# specific language governing permissions and limitations\n# under the License.\n\"\"\"Default configuration for the Airflow webserver.\"\"\"\nfrom __future__ import annotations\n\nimport os\n\nfrom airflow.www.fab_security.manager import AUTH_DB\n\n# from airflow.www.fab_security.manager import AUTH_LDAP\n# from airflow.www.fab_security.manager import AUTH_OAUTH\n# from airflow.www.fab_security.manager import AUTH_OID\n# from airflow.www.fab_security.manager import AUTH_REMOTE_USER\n\n\nbasedir = os.path.abspath(os.path.dirname(__file__))\n\n# Flask-WTF flag for CSRF\nWTF_CSRF_ENABLED = True\n\n# ----------------------------------------------------\n# AUTHENTICATION CONFIG\n# ----------------------------------------------------\n# For details on how to set up each of the following authentication, see\n# http://flask-appbuilder.readthedocs.io/en/latest/security.html# authentication-methods\n# for details.\n\n# The authentication type\n# AUTH_OID : Is for OpenID\n# AUTH_DB : Is for database\n# AUTH_LDAP : Is for LDAP\n# AUTH_REMOTE_USER : Is for using REMOTE_USER from web server\n# AUTH_OAUTH : Is for OAuth\nAUTH_TYPE = AUTH_DB\n\n# Uncomment to setup Full admin role name\n# AUTH_ROLE_ADMIN = 'Admin'\n\n# Uncomment and set to desired role to enable access without authentication\n# AUTH_ROLE_PUBLIC = 'Viewer'\n\n# Will allow user self registration\n# AUTH_USER_REGISTRATION = True\n\n# The recaptcha it's automatically enabled for user self registration is active and the keys are necessary\n# RECAPTCHA_PRIVATE_KEY = PRIVATE_KEY\n# RECAPTCHA_PUBLIC_KEY = PUBLIC_KEY\n\n# Config for Flask-Mail necessary for user self registration\n# MAIL_SERVER = 'smtp.gmail.com'\n# MAIL_USE_TLS = True\n# MAIL_USERNAME = 'yourappemail@gmail.com'\n# MAIL_PASSWORD = 'passwordformail'\n# MAIL_DEFAULT_SENDER = 'sender@gmail.com'\n\n# The default user self registration role\n# AUTH_USER_REGISTRATION_ROLE = \"Public\"\n\n# When using OAuth Auth, uncomment to setup provider(s) info\n# Google OAuth example:\n# OAUTH_PROVIDERS = [{\n#   'name':'google',\n#     'token_key':'access_token',\n#     'icon':'fa-google',\n#         'remote_app': {\n#             'api_base_url':'https://www.googleapis.com/oauth2/v2/',\n#             'client_kwargs':{\n#                 'scope': 'email profile'\n#             },\n#             'access_token_url':'https://accounts.google.com/o/oauth2/token',\n#             'authorize_url':'https://accounts.google.com/o/oauth2/auth',\n#             'request_token_url': None,\n#             'client_id': GOOGLE_KEY,\n#             'client_secret': GOOGLE_SECRET_KEY,\n#         }\n# }]\n\n# When using LDAP Auth, setup the ldap server\n# AUTH_LDAP_SERVER = \"ldap://ldapserver.new\"\n\n# When using OpenID Auth, uncomment to setup OpenID providers.\n# example for OpenID authentication\n# OPENID_PROVIDERS = [\n#    { 'name': 'Yahoo', 'url': 'https://me.yahoo.com' },\n#    { 'name': 'AOL', 'url': 'http://openid.aol.com/<username>' },\n#    { 'name': 'Flickr', 'url': 'http://www.flickr.com/<username>' },\n#    { 'name': 'MyOpenID', 'url': 'https://www.myopenid.com' }]\n\n# ----------------------------------------------------\n# Theme CONFIG\n# ----------------------------------------------------\n# Flask App Builder comes up with a number of predefined themes\n# that you can use for Apache Airflow.\n# http://flask-appbuilder.readthedocs.io/en/latest/customizing.html#changing-themes\n# Please make sure to remove \"navbar_color\" configuration from airflow.cfg\n# in order to fully utilize the theme. (or use that property in conjunction with theme)\n# APP_THEME = \"bootstrap-theme.css\"  # default bootstrap\n# APP_THEME = \"amelia.css\"\n# APP_THEME = \"cerulean.css\"\n# APP_THEME = \"cosmo.css\"\n# APP_THEME = \"cyborg.css\"\n# APP_THEME = \"darkly.css\"\n# APP_THEME = \"flatly.css\"\n# APP_THEME = \"journal.css\"\n# APP_THEME = \"lumen.css\"\n# APP_THEME = \"paper.css\"\n# APP_THEME = \"readable.css\"\n# APP_THEME = \"sandstone.css\"\n# APP_THEME = \"simplex.css\"\n# APP_THEME = \"slate.css\"\n# APP_THEME = \"solar.css\"\n# APP_THEME = \"spacelab.css\"\n# APP_THEME = \"superhero.css\"\n# APP_THEME = \"united.css\"\n# APP_THEME = \"yeti.css\"\n", "path": "airflow/config_templates/default_webserver_config.py"}], "after_files": [{"content": "#\n# Licensed to the Apache Software Foundation (ASF) under one\n# or more contributor license agreements.  See the NOTICE file\n# distributed with this work for additional information\n# regarding copyright ownership.  The ASF licenses this file\n# to you under the Apache License, Version 2.0 (the\n# \"License\"); you may not use this file except in compliance\n# with the License.  You may obtain a copy of the License at\n#\n#   http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing,\n# software distributed under the License is distributed on an\n# \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\n# KIND, either express or implied.  See the License for the\n# specific language governing permissions and limitations\n# under the License.\n\"\"\"Default configuration for the Airflow webserver.\"\"\"\nfrom __future__ import annotations\n\nimport os\n\nfrom airflow.www.fab_security.manager import AUTH_DB\n\n# from airflow.www.fab_security.manager import AUTH_LDAP\n# from airflow.www.fab_security.manager import AUTH_OAUTH\n# from airflow.www.fab_security.manager import AUTH_OID\n# from airflow.www.fab_security.manager import AUTH_REMOTE_USER\n\n\nbasedir = os.path.abspath(os.path.dirname(__file__))\n\n# Flask-WTF flag for CSRF\nWTF_CSRF_ENABLED = True\nWTF_CSRF_TIME_LIMIT = None\n\n# ----------------------------------------------------\n# AUTHENTICATION CONFIG\n# ----------------------------------------------------\n# For details on how to set up each of the following authentication, see\n# http://flask-appbuilder.readthedocs.io/en/latest/security.html# authentication-methods\n# for details.\n\n# The authentication type\n# AUTH_OID : Is for OpenID\n# AUTH_DB : Is for database\n# AUTH_LDAP : Is for LDAP\n# AUTH_REMOTE_USER : Is for using REMOTE_USER from web server\n# AUTH_OAUTH : Is for OAuth\nAUTH_TYPE = AUTH_DB\n\n# Uncomment to setup Full admin role name\n# AUTH_ROLE_ADMIN = 'Admin'\n\n# Uncomment and set to desired role to enable access without authentication\n# AUTH_ROLE_PUBLIC = 'Viewer'\n\n# Will allow user self registration\n# AUTH_USER_REGISTRATION = True\n\n# The recaptcha it's automatically enabled for user self registration is active and the keys are necessary\n# RECAPTCHA_PRIVATE_KEY = PRIVATE_KEY\n# RECAPTCHA_PUBLIC_KEY = PUBLIC_KEY\n\n# Config for Flask-Mail necessary for user self registration\n# MAIL_SERVER = 'smtp.gmail.com'\n# MAIL_USE_TLS = True\n# MAIL_USERNAME = 'yourappemail@gmail.com'\n# MAIL_PASSWORD = 'passwordformail'\n# MAIL_DEFAULT_SENDER = 'sender@gmail.com'\n\n# The default user self registration role\n# AUTH_USER_REGISTRATION_ROLE = \"Public\"\n\n# When using OAuth Auth, uncomment to setup provider(s) info\n# Google OAuth example:\n# OAUTH_PROVIDERS = [{\n#   'name':'google',\n#     'token_key':'access_token',\n#     'icon':'fa-google',\n#         'remote_app': {\n#             'api_base_url':'https://www.googleapis.com/oauth2/v2/',\n#             'client_kwargs':{\n#                 'scope': 'email profile'\n#             },\n#             'access_token_url':'https://accounts.google.com/o/oauth2/token',\n#             'authorize_url':'https://accounts.google.com/o/oauth2/auth',\n#             'request_token_url': None,\n#             'client_id': GOOGLE_KEY,\n#             'client_secret': GOOGLE_SECRET_KEY,\n#         }\n# }]\n\n# When using LDAP Auth, setup the ldap server\n# AUTH_LDAP_SERVER = \"ldap://ldapserver.new\"\n\n# When using OpenID Auth, uncomment to setup OpenID providers.\n# example for OpenID authentication\n# OPENID_PROVIDERS = [\n#    { 'name': 'Yahoo', 'url': 'https://me.yahoo.com' },\n#    { 'name': 'AOL', 'url': 'http://openid.aol.com/<username>' },\n#    { 'name': 'Flickr', 'url': 'http://www.flickr.com/<username>' },\n#    { 'name': 'MyOpenID', 'url': 'https://www.myopenid.com' }]\n\n# ----------------------------------------------------\n# Theme CONFIG\n# ----------------------------------------------------\n# Flask App Builder comes up with a number of predefined themes\n# that you can use for Apache Airflow.\n# http://flask-appbuilder.readthedocs.io/en/latest/customizing.html#changing-themes\n# Please make sure to remove \"navbar_color\" configuration from airflow.cfg\n# in order to fully utilize the theme. (or use that property in conjunction with theme)\n# APP_THEME = \"bootstrap-theme.css\"  # default bootstrap\n# APP_THEME = \"amelia.css\"\n# APP_THEME = \"cerulean.css\"\n# APP_THEME = \"cosmo.css\"\n# APP_THEME = \"cyborg.css\"\n# APP_THEME = \"darkly.css\"\n# APP_THEME = \"flatly.css\"\n# APP_THEME = \"journal.css\"\n# APP_THEME = \"lumen.css\"\n# APP_THEME = \"paper.css\"\n# APP_THEME = \"readable.css\"\n# APP_THEME = \"sandstone.css\"\n# APP_THEME = \"simplex.css\"\n# APP_THEME = \"slate.css\"\n# APP_THEME = \"solar.css\"\n# APP_THEME = \"spacelab.css\"\n# APP_THEME = \"superhero.css\"\n# APP_THEME = \"united.css\"\n# APP_THEME = \"yeti.css\"\n", "path": "airflow/config_templates/default_webserver_config.py"}]}