  class TestContextProcessor(SimpleTestCase):
  
      def test_force_text_on_token(self):
          request = HttpRequest()
          request.META['CSRF_COOKIE'] = 'test-token'
          token = csrf(request).get('csrf_token')
          self.assertEqual(json.dumps(force_text(token)), '"test-token"')
 
</s> remove         self.assertEqual(json.dumps(force_text(token)), '"test-token"')
 </s> add         self.assertTrue(equivalent_tokens(force_text(token), test_token)) </s> remove     # The csrf token is potentially from an untrusted source, so could have
    # characters that need dealing with.
    _csrf_id_cookie = b"<1>\xc2\xa1"
    _csrf_id = "1"
 </s> add     _csrf_id = _csrf_id_cookie = '1bcdefghij2bcdefghij3bcdefghij4bcdefghij5bcdefghij6bcdefghijABCD' </s> remove             csrf_token = _sanitize_token(
                request.COOKIES[settings.CSRF_COOKIE_NAME])
            # Use same token next time
            request.META['CSRF_COOKIE'] = csrf_token
 </s> add             cookie_token = request.COOKIES[settings.CSRF_COOKIE_NAME] </s> remove     return request.META["CSRF_COOKIE"]
 </s> add     return _salt_cipher_secret(csrf_secret)
        test_token = '1bcdefghij2bcdefghij3bcdefghij4bcdefghij5bcdefghij6bcdefghijABCD'
        request.META['CSRF_COOKIE'] = test_token
  class TestContextProcessor(SimpleTestCase):
  
      def test_force_text_on_token(self):
          request = HttpRequest()
        test_token = '1bcdefghij2bcdefghij3bcdefghij4bcdefghij5bcdefghij6bcdefghijABCD'
        request.META['CSRF_COOKIE'] = test_token
          token = csrf(request).get('csrf_token')
          self.assertEqual(json.dumps(force_text(token)), '"test-token"')
keep keep keep keep replace keep keep
 Fixed #20869 -- made CSRF tokens change every request by salt-encrypting them

Note that the cookie is not changed every request, just the token retrieved
by the `get_token()` method (used also by the `{% csrf_token %}` tag).

While at it, made token validation strict: Where, before, any length was
accepted and non-ASCII chars were ignored, we now treat anything other than
`[A-Za-z0-9]{64}` as invalid (except for 32-char tokens, which, for
backwards-compatibility, are accepted and replaced by 64-char ones).

Thanks Trac user patrys for reporting, github user adambrenecki
for initial patch, Tim Graham for help, and Curtis Maloney,
Collin Anderson, Florian Apolloner, Markus Holtermann & Jon Dufresne
for reviews. 
tests/csrf_tests/test_context_processor.py