          return req
  
      def _check_token_present(self, response, csrf_id=None):
          text = text_type(response.content, response.charset)
          match = re.search("name='csrfmiddlewaretoken' value='(.*?)'", text)
          csrf_token = csrf_id or self._csrf_id
          self.assertTrue(
 
</s> remove         self.assertContains(response, "name='csrfmiddlewaretoken' value='%s'" % (csrf_id or self._csrf_id))
 </s> add         text = text_type(response.content, response.charset)
        match = re.search("name='csrfmiddlewaretoken' value='(.*?)'", text)
        csrf_token = csrf_id or self._csrf_id
        self.assertTrue(
            match and equivalent_tokens(csrf_token, match.group(1)),
            "Could not find csrfmiddlewaretoken to match %s" % csrf_token
        ) </s> remove         expected = (
            '<input type="hidden" name="csrfmiddlewaretoken" '
            'value="{}" />'.format(get_token(request)))

        self.assertHTMLEqual(content, expected)
 </s> add         expected = '<input type="hidden" name="csrfmiddlewaretoken" value="([^"]+)" />'
        match = re.match(expected, content) or re.match(expected.replace('"', "'"), content)
        self.assertTrue(match, "hidden csrftoken field not found in output")
        self.assertTrue(equivalent_tokens(match.group(1), get_token(request))) </s> remove             csrf_token = _sanitize_token(
                request.COOKIES[settings.CSRF_COOKIE_NAME])
            # Use same token next time
            request.META['CSRF_COOKIE'] = csrf_token
 </s> add             cookie_token = request.COOKIES[settings.CSRF_COOKIE_NAME] </s> remove         token = 'ABC'
 </s> add         token = ('ABC' + self._csrf_id)[:CSRF_TOKEN_LENGTH]
    def _get_POST_bare_secret_csrf_cookie_request(self):
        req = self._get_POST_no_csrf_cookie_request()
        req.COOKIES[settings.CSRF_COOKIE_NAME] = self._csrf_id_cookie[:32]
        return req

    def _get_POST_bare_secret_csrf_cookie_request_with_token(self):
        req = self._get_POST_bare_secret_csrf_cookie_request()
        req.POST['csrfmiddlewaretoken'] = self._csrf_id_cookie[:32]
        return req

          return req
  
    def _get_POST_bare_secret_csrf_cookie_request(self):
        req = self._get_POST_no_csrf_cookie_request()
        req.COOKIES[settings.CSRF_COOKIE_NAME] = self._csrf_id_cookie[:32]
        return req

    def _get_POST_bare_secret_csrf_cookie_request_with_token(self):
        req = self._get_POST_bare_secret_csrf_cookie_request()
        req.POST['csrfmiddlewaretoken'] = self._csrf_id_cookie[:32]
        return req

      def _check_token_present(self, response, csrf_id=None):
          text = text_type(response.content, response.charset)
          match = re.search("name='csrfmiddlewaretoken' value='(.*?)'", text)
          csrf_token = csrf_id or self._csrf_id
          self.assertTrue(
keep add keep keep keep keep keep
 Fixed #20869 -- made CSRF tokens change every request by salt-encrypting them

Note that the cookie is not changed every request, just the token retrieved
by the `get_token()` method (used also by the `{% csrf_token %}` tag).

While at it, made token validation strict: Where, before, any length was
accepted and non-ASCII chars were ignored, we now treat anything other than
`[A-Za-z0-9]{64}` as invalid (except for 32-char tokens, which, for
backwards-compatibility, are accepted and replaced by 64-char ones).

Thanks Trac user patrys for reporting, github user adambrenecki
for initial patch, Tim Graham for help, and Curtis Maloney,
Collin Anderson, Florian Apolloner, Markus Holtermann & Jon Dufresne
for reviews. 
tests/csrf_tests/tests.py