[FIX] http: always salt CSRF token

1af543a399dccf837f7305df2b5e3e1eb0e90da9 removed the default time limit
for CSRF tokens, because of the usability issues and the limited
security benefit.

However the timestamp that was used to implement the limit also served as
a salt, making the CSRF token variable for each request. This is a
desirable property that can help mitigate some attacks, such as BREACH.

This patch re-introduces the variability by including a distant expiry
(1 year) when no specific time limit is passed. The purpose isn't to
expire the token, but simply to serve as a salt.

closes odoo/odoo#57274

Signed-off-by: Xavier Morel (xmo) <xmo@odoo.com>

0 files changed, 0 insertions, 0 deletions