

def check_xsrf_cookie(self):
    'Verifies that the ``_xsrf`` cookie matches the ``_xsrf`` argument.\n\n        To prevent cross-site request forgery, we set an ``_xsrf``\n        cookie and include the same value as a non-cookie\n        field with all ``POST`` requests. If the two do not match, we\n        reject the form submission as a potential forgery.\n\n        The ``_xsrf`` value may be set as either a form field named ``_xsrf``\n        or in a custom HTTP header named ``X-XSRFToken`` or ``X-CSRFToken``\n        (the latter is accepted for compatibility with Django).\n\n        See http://en.wikipedia.org/wiki/Cross-site_request_forgery\n\n        Prior to release 1.1.1, this check was ignored if the HTTP header\n        ``X-Requested-With: XMLHTTPRequest`` was present.  This exception\n        has been shown to be insecure and has been removed.  For more\n        information please see\n        http://www.djangoproject.com/weblog/2011/feb/08/security/\n        http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails\n\n        .. versionchanged:: 3.2.2\n           Added support for cookie version 2.  Both versions 1 and 2 are\n           supported.\n        '
    token = (self.get_argument('_xsrf', None) or self.request.headers.get('X-Xsrftoken') or self.request.headers.get('X-Csrftoken'))
    if (not token):
        raise HTTPError(403, "'_xsrf' argument missing from POST")
    (_, token, _) = self._decode_xsrf_token(token)
    (_, expected_token, _) = self._get_raw_xsrf_token()
    if (not _time_independent_equals(utf8(token), utf8(expected_token))):
        raise HTTPError(403, 'XSRF cookie does not match POST argument')

dataset/ETHPy150Open RobotWebTools/rosbridge_suite/rosbridge_server/src/tornado/web.py RequestHandler.check_xsrf_cookie/original