JSON encode the values in the request and cross-origin log lines

User agent, referrer, URL and Origin could fake additional fields with
quotes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

max/csrf.py

@@ -3,6 +3,7 @@ from functools import wraps
 from flask import request, session
 
 from max.crypto import constant_time_compare, get_random_string
+from max.log_format import format_log_fields
 from max.middlewares import BaseMiddleware, get_real_remote_addr
 
 CSRF_TOKEN_KEY = "csrf_token"
@@ -33,12 +34,14 @@ class CsrfMiddleware(BaseMiddleware):
         # Stateless check, so it also protects routes without a session (login)
         if not self.is_origin_allowed():
             self.app.logger.debug(
-                'Blocked cross-origin request %s %s origin="%s" sec_fetch_site="%s" from %s',
-                request.method,
-                request.path,
-                request.headers.get("Origin"),
-                request.headers.get("Sec-Fetch-Site"),
-                get_real_remote_addr(self.app),
+                "Blocked cross-origin request %s",
+                format_log_fields(
+                    method=request.method,
+                    path=request.path,
+                    origin=request.headers.get("Origin"),
+                    sec_fetch_site=request.headers.get("Sec-Fetch-Site"),
+                    ip=get_real_remote_addr(self.app),
+                ),
             )
             return "Cross-origin request blocked", 403