     modify cookies on your domain, it can't force a user to post to your
     application since that request won't come from your own exact domain.
  
     This also addresses a man-in-the-middle attack that's possible under HTTPS
     when using a session independent nonce, due to the fact that HTTP
     ``Set-Cookie`` headers are (unfortunately) accepted by clients even when
     they are talking to a site under HTTPS. (Referer checking is not done for
     HTTP requests because the presence of the ``Referer`` header isn't reliable
     enough under HTTP.)
  
 
</s> remove :ref:`CSRF protection works <how-csrf-works>` by checking for a nonce in each
 </s> add :ref:`CSRF protection works <how-csrf-works>` by checking for a secret in each </s> remove form. The malicious user would have to know the nonce, which is user specific
 </s> add form. The malicious user would have to know the secret, which is user specific </s> remove Why not use a new token for each request?
-----------------------------------------

Generating a new token for each request is problematic from a UI perspective
because it invalidates all previous forms. Most users would be very unhappy to
find that opening a new tab on your site has invalidated the form they had
just spent time filling out in another tab or that a form they accessed via
the back button could not be filled out.

 </s> add  </s> remove     (including ``GZipMiddleware``) are used on a website, the site becomes
    exposed to a number of possible attacks. These approaches can be used to
    compromise, among other things, Django's CSRF protection. Before using
    ``GZipMiddleware`` on your site, you should consider very carefully whether
    you are subject to these attacks. If you're in *any* doubt about whether
    you're affected, you should avoid using ``GZipMiddleware``. For more
    details, see the `the BREACH paper (PDF)`_ and `breachattack.com`_.
 </s> add     (including ``GZipMiddleware``) are used on a website, the site may become
    exposed to a number of possible attacks. Before using ``GZipMiddleware`` on
    your site, you should consider very carefully whether you are subject to
    these attacks. If you're in *any* doubt about whether you're affected, you
    should avoid using ``GZipMiddleware``. For more details, see the `the BREACH
    paper (PDF)`_ and `breachattack.com`_.
   when using a session independent secret, due to the fact that HTTP
     modify cookies on your domain, it can't force a user to post to your
     application since that request won't come from your own exact domain.
  
     This also addresses a man-in-the-middle attack that's possible under HTTPS
   when using a session independent secret, due to the fact that HTTP
     ``Set-Cookie`` headers are (unfortunately) accepted by clients even when
     they are talking to a site under HTTPS. (Referer checking is not done for
     HTTP requests because the presence of the ``Referer`` header isn't reliable
     enough under HTTP.)
  
keep keep keep keep replace keep keep keep keep keep
 Fixed #20869 -- made CSRF tokens change every request by salt-encrypting them

Note that the cookie is not changed every request, just the token retrieved
by the `get_token()` method (used also by the `{% csrf_token %}` tag).

While at it, made token validation strict: Where, before, any length was
accepted and non-ASCII chars were ignored, we now treat anything other than
`[A-Za-z0-9]{64}` as invalid (except for 32-char tokens, which, for
backwards-compatibility, are accepted and replaced by 64-char ones).

Thanks Trac user patrys for reporting, github user adambrenecki
for initial patch, Tim Graham for help, and Curtis Maloney,
Collin Anderson, Florian Apolloner, Markus Holtermann & Jon Dufresne
for reviews. 
docs/ref/csrf.txt