Function csrf_token

Scripts/ButSystem.py:1452–1466

csrf_token. Internal helper function. This docstring was added automatically to improve maintainability. Returns: Varies.

()

        if ra in ("127.0.0.1", "::1"):
            return self._pf(environ, start_response)
        # Strip forwarded headers to prevent spoofing when accessed directly on LAN.
        for k in ("HTTP_X_FORWARDED_FOR", "HTTP_X_FORWARDED_PROTO", "HTTP_X_FORWARDED_HOST", "HTTP_X_FORWARDED_PORT"):
            environ.pop(k, None)
        return self.app(environ, start_response)

app.wsgi_app = _LoopbackProxyFix(app.wsgi_app)
app.secret_key = load_or_create_session_key()
app.config.update(
    SESSION_COOKIE_HTTPONLY=True,
    SESSION_COOKIE_SAMESITE="Lax",
    SESSION_REFRESH_EACH_REQUEST=False,
    PERMANENT_SESSION_LIFETIME=timedelta(hours=12),
    # Global hard cap (needed for Flask/Werkzeug to accept large multipart bodies).
    # We enforce tighter per-feature limits below.
    MAX_CONTENT_LENGTH=(333 * 1024 * 1024) + (8 * 1024 * 1024),  # Per-request cap; 10GB vault files use 16MB chunks.
)

# ---------------------------