  import logging
  import re
  
  from django.conf import settings
  from django.urls import get_callable
  from django.utils.cache import patch_vary_headers
  from django.utils.crypto import constant_time_compare, get_random_string
  from django.utils.deprecation import MiddlewareMixin
 
</s> remove     CSRF_KEY_LENGTH, CsrfViewMiddleware, get_token,
 </s> add     CSRF_TOKEN_LENGTH, CsrfViewMiddleware,
    _compare_salted_tokens as equivalent_tokens, get_token, </s> remove from django.middleware.csrf import CsrfViewMiddleware, get_token
 </s> add from django.middleware.csrf import (
    CsrfViewMiddleware, _compare_salted_tokens as equivalent_tokens, get_token,
)
import string
  import logging
  import re
import string
  
  from django.conf import settings
  from django.urls import get_callable
  from django.utils.cache import patch_vary_headers
  from django.utils.crypto import constant_time_compare, get_random_string
  from django.utils.deprecation import MiddlewareMixin
keep add keep keep keep keep keep keep
 Fixed #20869 -- made CSRF tokens change every request by salt-encrypting them

Note that the cookie is not changed every request, just the token retrieved
by the `get_token()` method (used also by the `{% csrf_token %}` tag).

While at it, made token validation strict: Where, before, any length was
accepted and non-ASCII chars were ignored, we now treat anything other than
`[A-Za-z0-9]{64}` as invalid (except for 32-char tokens, which, for
backwards-compatibility, are accepted and replaced by 64-char ones).

Thanks Trac user patrys for reporting, github user adambrenecki
for initial patch, Tim Graham for help, and Curtis Maloney,
Collin Anderson, Florian Apolloner, Markus Holtermann & Jon Dufresne
for reviews. 
django/middleware/csrf.py