Language: Python
Label: vulnerable
CWE: CWE-203 \u2014 Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Code:
    def _create_token(cls, user_id: Optional[str], issued_on: float) -> str:
        """Creates a new CSRF token.

        Args:
            user_id: str|None. The user_id for which the token is generated.
            issued_on: float. The timestamp at which the token was issued.

        Returns:
            str. The generated CSRF token.
        """
        cls.init_csrf_secret()

        # The token has 4 parts: hash of the actor user id, hash of the page
        # name, hash of the time issued and plain text of the time issued.

        if user_id is None:
            user_id = cls._USER_ID_DEFAULT

        # Round time to seconds.
        issued_on_str = str(int(issued_on))

        digester = hmac.new(
            key=CSRF_SECRET.value.encode('utf-8'),
            digestmod='md5'
        )
        digester.update(user_id.encode('utf-8'))
        digester.update(b':')
        digester.update(issued_on_str.encode('utf-8'))

        digest = digester.digest()
        # The b64encode returns bytes, so we first need to decode the returned
        # bytes to string.
        token = '%s/%s' % (
            issued_on_str, base64.urlsafe_b64encode(digest).decode('utf-8'))

        return token