We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
CSRF token should be expire with session
### Apache Airflow version

2.5.0

### What happened

In the default configuration, the CSRF token [expires in one hour](https://pythonhosted.org/Flask-WTF/config.html#forms-and-csrf). This setting leads to frequent errors in the UI – for no good reason.


### What you think should happen instead

A short expiration date for the CSRF token is not the right value in my view and I [agree with this answer](https://security.stackexchange.com/a/56520/22108) that the CSRF token should basically never expire, instead pegging itself to the current session.

That is, the CSRF token should last as long as the current session. The easiest way to accomplish this is by generating the CSRF token from the session id.



### How to reproduce

_No response_

### Operating System

Linux

### Versions of Apache Airflow Providers

_No response_

### Deployment

Official Apache Airflow Helm Chart

### Deployment details

_No response_

### Anything else

_No response_

### Are you willing to submit PR?

- [ ] Yes I am willing to submit a PR!

### Code of Conduct

- [X] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `airflow/config_templates/default_webserver_config.py`
Content:
```
1 #
2 # Licensed to the Apache Software Foundation (ASF) under one
3 # or more contributor license agreements.  See the NOTICE file
4 # distributed with this work for additional information
5 # regarding copyright ownership.  The ASF licenses this file
6 # to you under the Apache License, Version 2.0 (the
7 # "License"); you may not use this file except in compliance
8 # with the License.  You may obtain a copy of the License at
9 #
10 #   http://www.apache.org/licenses/LICENSE-2.0
11 #
12 # Unless required by applicable law or agreed to in writing,
13 # software distributed under the License is distributed on an
14 # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15 # KIND, either express or implied.  See the License for the
16 # specific language governing permissions and limitations
17 # under the License.
18 """Default configuration for the Airflow webserver."""
19 from __future__ import annotations
20 
21 import os
22 
23 from airflow.www.fab_security.manager import AUTH_DB
24 
25 # from airflow.www.fab_security.manager import AUTH_LDAP
26 # from airflow.www.fab_security.manager import AUTH_OAUTH
27 # from airflow.www.fab_security.manager import AUTH_OID
28 # from airflow.www.fab_security.manager import AUTH_REMOTE_USER
29 
30 
31 basedir = os.path.abspath(os.path.dirname(__file__))
32 
33 # Flask-WTF flag for CSRF
34 WTF_CSRF_ENABLED = True
35 
36 # ----------------------------------------------------
37 # AUTHENTICATION CONFIG
38 # ----------------------------------------------------
39 # For details on how to set up each of the following authentication, see
40 # http://flask-appbuilder.readthedocs.io/en/latest/security.html# authentication-methods
41 # for details.
42 
43 # The authentication type
44 # AUTH_OID : Is for OpenID
45 # AUTH_DB : Is for database
46 # AUTH_LDAP : Is for LDAP
47 # AUTH_REMOTE_USER : Is for using REMOTE_USER from web server
48 # AUTH_OAUTH : Is for OAuth
49 AUTH_TYPE = AUTH_DB
50 
51 # Uncomment to setup Full admin role name
52 # AUTH_ROLE_ADMIN = 'Admin'
53 
54 # Uncomment and set to desired role to enable access without authentication
55 # AUTH_ROLE_PUBLIC = 'Viewer'
56 
57 # Will allow user self registration
58 # AUTH_USER_REGISTRATION = True
59 
60 # The recaptcha it's automatically enabled for user self registration is active and the keys are necessary
61 # RECAPTCHA_PRIVATE_KEY = PRIVATE_KEY
62 # RECAPTCHA_PUBLIC_KEY = PUBLIC_KEY
63 
64 # Config for Flask-Mail necessary for user self registration
65 # MAIL_SERVER = 'smtp.gmail.com'
66 # MAIL_USE_TLS = True
67 # MAIL_USERNAME = 'yourappemail@gmail.com'
68 # MAIL_PASSWORD = 'passwordformail'
69 # MAIL_DEFAULT_SENDER = 'sender@gmail.com'
70 
71 # The default user self registration role
72 # AUTH_USER_REGISTRATION_ROLE = "Public"
73 
74 # When using OAuth Auth, uncomment to setup provider(s) info
75 # Google OAuth example:
76 # OAUTH_PROVIDERS = [{
77 #   'name':'google',
78 #     'token_key':'access_token',
79 #     'icon':'fa-google',
80 #         'remote_app': {
81 #             'api_base_url':'https://www.googleapis.com/oauth2/v2/',
82 #             'client_kwargs':{
83 #                 'scope': 'email profile'
84 #             },
85 #             'access_token_url':'https://accounts.google.com/o/oauth2/token',
86 #             'authorize_url':'https://accounts.google.com/o/oauth2/auth',
87 #             'request_token_url': None,
88 #             'client_id': GOOGLE_KEY,
89 #             'client_secret': GOOGLE_SECRET_KEY,
90 #         }
91 # }]
92 
93 # When using LDAP Auth, setup the ldap server
94 # AUTH_LDAP_SERVER = "ldap://ldapserver.new"
95 
96 # When using OpenID Auth, uncomment to setup OpenID providers.
97 # example for OpenID authentication
98 # OPENID_PROVIDERS = [
99 #    { 'name': 'Yahoo', 'url': 'https://me.yahoo.com' },
100 #    { 'name': 'AOL', 'url': 'http://openid.aol.com/<username>' },
101 #    { 'name': 'Flickr', 'url': 'http://www.flickr.com/<username>' },
102 #    { 'name': 'MyOpenID', 'url': 'https://www.myopenid.com' }]
103 
104 # ----------------------------------------------------
105 # Theme CONFIG
106 # ----------------------------------------------------
107 # Flask App Builder comes up with a number of predefined themes
108 # that you can use for Apache Airflow.
109 # http://flask-appbuilder.readthedocs.io/en/latest/customizing.html#changing-themes
110 # Please make sure to remove "navbar_color" configuration from airflow.cfg
111 # in order to fully utilize the theme. (or use that property in conjunction with theme)
112 # APP_THEME = "bootstrap-theme.css"  # default bootstrap
113 # APP_THEME = "amelia.css"
114 # APP_THEME = "cerulean.css"
115 # APP_THEME = "cosmo.css"
116 # APP_THEME = "cyborg.css"
117 # APP_THEME = "darkly.css"
118 # APP_THEME = "flatly.css"
119 # APP_THEME = "journal.css"
120 # APP_THEME = "lumen.css"
121 # APP_THEME = "paper.css"
122 # APP_THEME = "readable.css"
123 # APP_THEME = "sandstone.css"
124 # APP_THEME = "simplex.css"
125 # APP_THEME = "slate.css"
126 # APP_THEME = "solar.css"
127 # APP_THEME = "spacelab.css"
128 # APP_THEME = "superhero.css"
129 # APP_THEME = "united.css"
130 # APP_THEME = "yeti.css"
131
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/airflow/config_templates/default_webserver_config.py b/airflow/config_templates/default_webserver_config.py
--- a/airflow/config_templates/default_webserver_config.py
+++ b/airflow/config_templates/default_webserver_config.py
@@ -32,6 +32,7 @@
 
 # Flask-WTF flag for CSRF
 WTF_CSRF_ENABLED = True
+WTF_CSRF_TIME_LIMIT = None
 
 # ----------------------------------------------------
 # AUTHENTICATION CONFIG

{"golden_diff": "diff --git a/airflow/config_templates/default_webserver_config.py b/airflow/config_templates/default_webserver_config.py\n--- a/airflow/config_templates/default_webserver_config.py\n+++ b/airflow/config_templates/default_webserver_config.py\n@@ -32,6 +32,7 @@\n \n # Flask-WTF flag for CSRF\n WTF_CSRF_ENABLED = True\n+WTF_CSRF_TIME_LIMIT = None\n \n # ----------------------------------------------------\n # AUTHENTICATION CONFIG\n", "issue": "CSRF token should be expire with session\n### Apache Airflow version\n\n2.5.0\n\n### What happened\n\nIn the default configuration, the CSRF token [expires in one hour](https://pythonhosted.org/Flask-WTF/config.html#forms-and-csrf). This setting leads to frequent errors in the UI \u2013 for no good reason.\r\n\n\n### What you think should happen instead\n\nA short expiration date for the CSRF token is not the right value in my view and I [agree with this answer](https://security.stackexchange.com/a/56520/22108) that the CSRF token should basically never expire, instead pegging itself to the current session.\r\n\r\nThat is, the CSRF token should last as long as the current session. The easiest way to accomplish this is by generating the CSRF token from the session id.\r\n\r\n\n\n### How to reproduce\n\n_No response_\n\n### Operating System\n\nLinux\n\n### Versions of Apache Airflow Providers\n\n_No response_\n\n### Deployment\n\nOfficial Apache Airflow Helm Chart\n\n### Deployment details\n\n_No response_\n\n### Anything else\n\n_No response_\n\n### Are you willing to submit PR?\n\n- [ ] Yes I am willing to submit a PR!\n\n### Code of Conduct\n\n- [X] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)\n\n", "before_files": [{"content": "#\n# Licensed to the Apache Software Foundation (ASF) under one\n# or more contributor license agreements.  See the NOTICE file\n# distributed with this work for additional information\n# regarding copyright ownership.  The ASF licenses this file\n# to you under the Apache License, Version 2.0 (the\n# \"License\"); you may not use this file except in compliance\n# with the License.  You may obtain a copy of the License at\n#\n#   http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing,\n# software distributed under the License is distributed on an\n# \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\n# KIND, either express or implied.  See the License for the\n# specific language governing permissions and limitations\n# under the License.\n\"\"\"Default configuration for the Airflow webserver.\"\"\"\nfrom __future__ import annotations\n\nimport os\n\nfrom airflow.www.fab_security.manager import AUTH_DB\n\n# from airflow.www.fab_security.manager import AUTH_LDAP\n# from airflow.www.fab_security.manager import AUTH_OAUTH\n# from airflow.www.fab_security.manager import AUTH_OID\n# from airflow.www.fab_security.manager import AUTH_REMOTE_USER\n\n\nbasedir = os.path.abspath(os.path.dirname(__file__))\n\n# Flask-WTF flag for CSRF\nWTF_CSRF_ENABLED = True\n\n# ----------------------------------------------------\n# AUTHENTICATION CONFIG\n# ----------------------------------------------------\n# For details on how to set up each of the following authentication, see\n# http://flask-appbuilder.readthedocs.io/en/latest/security.html# authentication-methods\n# for details.\n\n# The authentication type\n# AUTH_OID : Is for OpenID\n# AUTH_DB : Is for database\n# AUTH_LDAP : Is for LDAP\n# AUTH_REMOTE_USER : Is for using REMOTE_USER from web server\n# AUTH_OAUTH : Is for OAuth\nAUTH_TYPE = AUTH_DB\n\n# Uncomment to setup Full admin role name\n# AUTH_ROLE_ADMIN = 'Admin'\n\n# Uncomment and set to desired role to enable access without authentication\n# AUTH_ROLE_PUBLIC = 'Viewer'\n\n# Will allow user self registration\n# AUTH_USER_REGISTRATION = True\n\n# The recaptcha it's automatically enabled for user self registration is active and the keys are necessary\n# RECAPTCHA_PRIVATE_KEY = PRIVATE_KEY\n# RECAPTCHA_PUBLIC_KEY = PUBLIC_KEY\n\n# Config for Flask-Mail necessary for user self registration\n# MAIL_SERVER = 'smtp.gmail.com'\n# MAIL_USE_TLS = True\n# MAIL_USERNAME = 'yourappemail@gmail.com'\n# MAIL_PASSWORD = 'passwordformail'\n# MAIL_DEFAULT_SENDER = 'sender@gmail.com'\n\n# The default user self registration role\n# AUTH_USER_REGISTRATION_ROLE = \"Public\"\n\n# When using OAuth Auth, uncomment to setup provider(s) info\n# Google OAuth example:\n# OAUTH_PROVIDERS = [{\n#   'name':'google',\n#     'token_key':'access_token',\n#     'icon':'fa-google',\n#         'remote_app': {\n#             'api_base_url':'https://www.googleapis.com/oauth2/v2/',\n#             'client_kwargs':{\n#                 'scope': 'email profile'\n#             },\n#             'access_token_url':'https://accounts.google.com/o/oauth2/token',\n#             'authorize_url':'https://accounts.google.com/o/oauth2/auth',\n#             'request_token_url': None,\n#             'client_id': GOOGLE_KEY,\n#             'client_secret': GOOGLE_SECRET_KEY,\n#         }\n# }]\n\n# When using LDAP Auth, setup the ldap server\n# AUTH_LDAP_SERVER = \"ldap://ldapserver.new\"\n\n# When using OpenID Auth, uncomment to setup OpenID providers.\n# example for OpenID authentication\n# OPENID_PROVIDERS = [\n#    { 'name': 'Yahoo', 'url': 'https://me.yahoo.com' },\n#    { 'name': 'AOL', 'url': 'http://openid.aol.com/<username>' },\n#    { 'name': 'Flickr', 'url': 'http://www.flickr.com/<username>' },\n#    { 'name': 'MyOpenID', 'url': 'https://www.myopenid.com' }]\n\n# ----------------------------------------------------\n# Theme CONFIG\n# ----------------------------------------------------\n# Flask App Builder comes up with a number of predefined themes\n# that you can use for Apache Airflow.\n# http://flask-appbuilder.readthedocs.io/en/latest/customizing.html#changing-themes\n# Please make sure to remove \"navbar_color\" configuration from airflow.cfg\n# in order to fully utilize the theme. (or use that property in conjunction with theme)\n# APP_THEME = \"bootstrap-theme.css\"  # default bootstrap\n# APP_THEME = \"amelia.css\"\n# APP_THEME = \"cerulean.css\"\n# APP_THEME = \"cosmo.css\"\n# APP_THEME = \"cyborg.css\"\n# APP_THEME = \"darkly.css\"\n# APP_THEME = \"flatly.css\"\n# APP_THEME = \"journal.css\"\n# APP_THEME = \"lumen.css\"\n# APP_THEME = \"paper.css\"\n# APP_THEME = \"readable.css\"\n# APP_THEME = \"sandstone.css\"\n# APP_THEME = \"simplex.css\"\n# APP_THEME = \"slate.css\"\n# APP_THEME = \"solar.css\"\n# APP_THEME = \"spacelab.css\"\n# APP_THEME = \"superhero.css\"\n# APP_THEME = \"united.css\"\n# APP_THEME = \"yeti.css\"\n", "path": "airflow/config_templates/default_webserver_config.py"}], "after_files": [{"content": "#\n# Licensed to the Apache Software Foundation (ASF) under one\n# or more contributor license agreements.  See the NOTICE file\n# distributed with this work for additional information\n# regarding copyright ownership.  The ASF licenses this file\n# to you under the Apache License, Version 2.0 (the\n# \"License\"); you may not use this file except in compliance\n# with the License.  You may obtain a copy of the License at\n#\n#   http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing,\n# software distributed under the License is distributed on an\n# \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\n# KIND, either express or implied.  See the License for the\n# specific language governing permissions and limitations\n# under the License.\n\"\"\"Default configuration for the Airflow webserver.\"\"\"\nfrom __future__ import annotations\n\nimport os\n\nfrom airflow.www.fab_security.manager import AUTH_DB\n\n# from airflow.www.fab_security.manager import AUTH_LDAP\n# from airflow.www.fab_security.manager import AUTH_OAUTH\n# from airflow.www.fab_security.manager import AUTH_OID\n# from airflow.www.fab_security.manager import AUTH_REMOTE_USER\n\n\nbasedir = os.path.abspath(os.path.dirname(__file__))\n\n# Flask-WTF flag for CSRF\nWTF_CSRF_ENABLED = True\nWTF_CSRF_TIME_LIMIT = None\n\n# ----------------------------------------------------\n# AUTHENTICATION CONFIG\n# ----------------------------------------------------\n# For details on how to set up each of the following authentication, see\n# http://flask-appbuilder.readthedocs.io/en/latest/security.html# authentication-methods\n# for details.\n\n# The authentication type\n# AUTH_OID : Is for OpenID\n# AUTH_DB : Is for database\n# AUTH_LDAP : Is for LDAP\n# AUTH_REMOTE_USER : Is for using REMOTE_USER from web server\n# AUTH_OAUTH : Is for OAuth\nAUTH_TYPE = AUTH_DB\n\n# Uncomment to setup Full admin role name\n# AUTH_ROLE_ADMIN = 'Admin'\n\n# Uncomment and set to desired role to enable access without authentication\n# AUTH_ROLE_PUBLIC = 'Viewer'\n\n# Will allow user self registration\n# AUTH_USER_REGISTRATION = True\n\n# The recaptcha it's automatically enabled for user self registration is active and the keys are necessary\n# RECAPTCHA_PRIVATE_KEY = PRIVATE_KEY\n# RECAPTCHA_PUBLIC_KEY = PUBLIC_KEY\n\n# Config for Flask-Mail necessary for user self registration\n# MAIL_SERVER = 'smtp.gmail.com'\n# MAIL_USE_TLS = True\n# MAIL_USERNAME = 'yourappemail@gmail.com'\n# MAIL_PASSWORD = 'passwordformail'\n# MAIL_DEFAULT_SENDER = 'sender@gmail.com'\n\n# The default user self registration role\n# AUTH_USER_REGISTRATION_ROLE = \"Public\"\n\n# When using OAuth Auth, uncomment to setup provider(s) info\n# Google OAuth example:\n# OAUTH_PROVIDERS = [{\n#   'name':'google',\n#     'token_key':'access_token',\n#     'icon':'fa-google',\n#         'remote_app': {\n#             'api_base_url':'https://www.googleapis.com/oauth2/v2/',\n#             'client_kwargs':{\n#                 'scope': 'email profile'\n#             },\n#             'access_token_url':'https://accounts.google.com/o/oauth2/token',\n#             'authorize_url':'https://accounts.google.com/o/oauth2/auth',\n#             'request_token_url': None,\n#             'client_id': GOOGLE_KEY,\n#             'client_secret': GOOGLE_SECRET_KEY,\n#         }\n# }]\n\n# When using LDAP Auth, setup the ldap server\n# AUTH_LDAP_SERVER = \"ldap://ldapserver.new\"\n\n# When using OpenID Auth, uncomment to setup OpenID providers.\n# example for OpenID authentication\n# OPENID_PROVIDERS = [\n#    { 'name': 'Yahoo', 'url': 'https://me.yahoo.com' },\n#    { 'name': 'AOL', 'url': 'http://openid.aol.com/<username>' },\n#    { 'name': 'Flickr', 'url': 'http://www.flickr.com/<username>' },\n#    { 'name': 'MyOpenID', 'url': 'https://www.myopenid.com' }]\n\n# ----------------------------------------------------\n# Theme CONFIG\n# ----------------------------------------------------\n# Flask App Builder comes up with a number of predefined themes\n# that you can use for Apache Airflow.\n# http://flask-appbuilder.readthedocs.io/en/latest/customizing.html#changing-themes\n# Please make sure to remove \"navbar_color\" configuration from airflow.cfg\n# in order to fully utilize the theme. (or use that property in conjunction with theme)\n# APP_THEME = \"bootstrap-theme.css\"  # default bootstrap\n# APP_THEME = \"amelia.css\"\n# APP_THEME = \"cerulean.css\"\n# APP_THEME = \"cosmo.css\"\n# APP_THEME = \"cyborg.css\"\n# APP_THEME = \"darkly.css\"\n# APP_THEME = \"flatly.css\"\n# APP_THEME = \"journal.css\"\n# APP_THEME = \"lumen.css\"\n# APP_THEME = \"paper.css\"\n# APP_THEME = \"readable.css\"\n# APP_THEME = \"sandstone.css\"\n# APP_THEME = \"simplex.css\"\n# APP_THEME = \"slate.css\"\n# APP_THEME = \"solar.css\"\n# APP_THEME = \"spacelab.css\"\n# APP_THEME = \"superhero.css\"\n# APP_THEME = \"united.css\"\n# APP_THEME = \"yeti.css\"\n", "path": "airflow/config_templates/default_webserver_config.py"}]}