  
  You can apply GZip compression to individual views using the
  :func:`~django.views.decorators.gzip.gzip_page()` decorator.
  
  Conditional GET middleware
  --------------------------
  
  .. module:: django.middleware.http
     :synopsis: Middleware handling advanced HTTP features.
  
 
</s> remove     (including ``GZipMiddleware``) are used on a website, the site becomes
    exposed to a number of possible attacks. These approaches can be used to
    compromise, among other things, Django's CSRF protection. Before using
    ``GZipMiddleware`` on your site, you should consider very carefully whether
    you are subject to these attacks. If you're in *any* doubt about whether
    you're affected, you should avoid using ``GZipMiddleware``. For more
    details, see the `the BREACH paper (PDF)`_ and `breachattack.com`_.
 </s> add     (including ``GZipMiddleware``) are used on a website, the site may become
    exposed to a number of possible attacks. Before using ``GZipMiddleware`` on
    your site, you should consider very carefully whether you are subject to
    these attacks. If you're in *any* doubt about whether you're affected, you
    should avoid using ``GZipMiddleware``. For more details, see the `the BREACH
    paper (PDF)`_ and `breachattack.com`_. </s> remove                 # nonce we're using. So the MITM can circumvent the CSRF
 </s> add                 # secret we're using. So the MITM can circumvent the CSRF </s> remove    when using a session independent nonce, due to the fact that HTTP
 </s> add    when using a session independent secret, due to the fact that HTTP
.. versionchanged:: 1.10

    In older versions, Django's CSRF protection mechanism was vulnerable to
    BREACH attacks when compression was used. This is no longer the case, but
    you should still take care not to compromise your own secrets this way.

  
  You can apply GZip compression to individual views using the
  :func:`~django.views.decorators.gzip.gzip_page()` decorator.
  
.. versionchanged:: 1.10

    In older versions, Django's CSRF protection mechanism was vulnerable to
    BREACH attacks when compression was used. This is no longer the case, but
    you should still take care not to compromise your own secrets this way.

  Conditional GET middleware
  --------------------------
  
  .. module:: django.middleware.http
     :synopsis: Middleware handling advanced HTTP features.
  
keep keep keep add keep keep keep keep keep keep
 Fixed #20869 -- made CSRF tokens change every request by salt-encrypting them

Note that the cookie is not changed every request, just the token retrieved
by the `get_token()` method (used also by the `{% csrf_token %}` tag).

While at it, made token validation strict: Where, before, any length was
accepted and non-ASCII chars were ignored, we now treat anything other than
`[A-Za-z0-9]{64}` as invalid (except for 32-char tokens, which, for
backwards-compatibility, are accepted and replaced by 64-char ones).

Thanks Trac user patrys for reporting, github user adambrenecki
for initial patch, Tim Graham for help, and Curtis Maloney,
Collin Anderson, Florian Apolloner, Markus Holtermann & Jon Dufresne
for reviews. 
docs/ref/middleware.txt