docs: def ValidateCSRFTokenOrRaise(request):
    """Decorator for WSGI handler that checks CSRF cookie against the request."""
  
    # CSRF check doesn't make sense for GET/HEAD methods, because they can
    # (and are) used when downloading files through <a href> links - and
    # there's no way to set X-CSRFToken header in this case.
    if request.method in ("GET", "HEAD"):
      return
  
    # In the ideal world only JavaScript can be used to add a custom header, and
    # only within its origin. By default, browsers don't allow JavaScript to
    # make cross origin requests.
    #
    # Unfortunately, in the real world due to bugs in browsers plugins, it can't
    # be guaranteed that a page won't set an HTTP request with a custom header
    # set. That's why we also check the contents of a header via an HMAC check
    # with a server-stored secret.
    #
    # See for more details:
    # https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet
    # (Protecting REST Services: Use of Custom Request Headers).
    csrf_token = request.headers.get("X-CSRFToken", "").encode("ascii")
    if not csrf_token:
      logging.info("Did not find headers CSRF token for: %s", request.path)
      raise werkzeug_exceptions.Forbidden("CSRF token is missing")
  
    try:
      decoded = base64.urlsafe_b64decode(csrf_token + b"==")
      digest, token_time = decoded.rsplit(CSRF_DELIMITER, 1)
      token_time = int(token_time)
    except (TypeError, ValueError):
      logging.info("Malformed CSRF token for: %s", request.path)
      raise werkzeug_exceptions.Forbidden("Malformed CSRF token")
  
    if len(digest) != hashlib.sha256().digest_size:
      logging.info("Invalid digest size for: %s", request.path)
      raise werkzeug_exceptions.Forbidden("Malformed CSRF token digest")
  
    expected = GenerateCSRFToken(request.user, token_time)
    if not constant_time.bytes_eq(csrf_token, expected):
      logging.info("Non-matching CSRF token for: %s", request.path)
      raise werkzeug_exceptions.Forbidden("Non-matching CSRF token")
  
    current_time = rdfvalue.RDFDatetime.Now().AsMicrosecondsSinceEpoch()
    if current_time - token_time > CSRF_TOKEN_DURATION.microseconds:
      logging.info("Expired CSRF token for: %s", request.path)
      raise werkzeug_exceptions.Forbidden("Expired CSRF token")