lepture/flask-wtf — pull request #156 by oscarh (2014-10-03 14:19:17+00:00)
Title: Don't use floating point for expiration

On one of my machines, the return value of time.time() seem to have
different precision from other floats. This means that the value
generated by time.time() cannot be converted back to a float when
validating the CSRF signature. See example below. I also don't see why
we would need sub second precision here, so I just changed the
expiration value to be an int.

>>> t = time.time()
>>> t
1412343858.6668283
>>> float(t)
1412343858.6668283
>>> s = '%s' % t
'1412343858.6668283'
>>> float(s)
1412343858.6668286
>>> t2 = 1412343858.6668283
>>> t2
1412343858.6668286

There are alternative approaches to this, such as keeping the float and doing the hmac verification earlier, on the string. The cast to float is just for comparison with time.time() anyway