

@property
def xsrf_token(self):
    "The XSRF-prevention token for the current user/session.\n\n        To prevent cross-site request forgery, we set an '_xsrf' cookie\n        and include the same '_xsrf' value as an argument with all POST\n        requests. If the two do not match, we reject the form submission\n        as a potential forgery.\n\n        See http://en.wikipedia.org/wiki/Cross-site_request_forgery\n\n        .. versionchanged:: 3.2.2\n           The xsrf token will now be have a random mask applied in every\n           request, which makes it safe to include the token in pages\n           that are compressed.  See http://breachattack.com for more\n           information on the issue fixed by this change.  Old (version 1)\n           cookies will be converted to version 2 when this method is called\n           unless the ``xsrf_cookie_version`` `Application` setting is\n           set to 1.\n        "
    if (not hasattr(self, '_xsrf_token')):
        (version, token, timestamp) = self._get_raw_xsrf_token()
        output_version = self.settings.get('xsrf_cookie_version', 2)
        if (output_version == 1):
            self._xsrf_token = binascii.b2a_hex(token)
        elif (output_version == 2):
            mask = os.urandom(4)
            self._xsrf_token = b'|'.join([b'2', binascii.b2a_hex(mask), binascii.b2a_hex(_websocket_mask(mask, timestamp)), utf8(str(int(timestamp)))])
        else:
            raise ValueError('unknown xsrf cookie version %d', output_version)
        if (version is None):
            expires_days = (30 if self.current_user else None)
            self.set_cookie('_xsrf', self._xsrf_token, expires_days=expires_days)
    return self._xsrf_token

dataset/ETHPy150Open RobotWebTools/rosbridge_suite/rosbridge_server/src/tornado/web.py RequestHandler.xsrf_token/VarMisuse@120/492 `token`->`timestamp`