                  # submits it via JavaScript.
                  #
                  # The attacker will need to provide a CSRF cookie and token, but
                  # that's no problem for a MITM and the session-independent
                  # nonce we're using. So the MITM can circumvent the CSRF
                  # protection. This is true for any HTTP connection, but anyone
                  # using HTTPS expects better! For this reason, for
                  # https://example.com/ we need additional protection that treats
                  # http://example.com/ as completely untrusted. Under HTTPS,
                  # Barth et al. found that the Referer header is missing for
 
</s> remove form. The malicious user would have to know the nonce, which is user specific
 </s> add form. The malicious user would have to know the secret, which is user specific </s> remove     # Allow only alphanum
    if len(token) > CSRF_KEY_LENGTH:
        return _get_new_csrf_key()
    token = re.sub('[^a-zA-Z0-9]+', '', force_text(token))
    if token == "":
        # In case the cookie has been truncated to nothing at some point.
        return _get_new_csrf_key()
    return token
 </s> add     # Allow only ASCII alphanumerics
    if re.search('[^a-zA-Z0-9]', force_text(token)):
        return _get_new_csrf_token()
    elif len(token) == CSRF_TOKEN_LENGTH:
        return token
    elif len(token) == CSRF_SECRET_LENGTH:
        # Older Django versions set cookies to values of CSRF_SECRET_LENGTH
        # alphanumeric characters. For backwards compatibility, accept
        # such values as unsalted secrets.
        # It's easier to salt here and be consistent later, rather than add
        # different code paths in the checks, although that might be a tad more
        # efficient.
        return _salt_cipher_secret(token)
    return _get_new_csrf_token()


def _compare_salted_tokens(request_csrf_token, csrf_token):
    # Assume both arguments are sanitized -- that is, strings of
    # length CSRF_TOKEN_LENGTH, all CSRF_ALLOWED_CHARS.
    return constant_time_compare(
        _unsalt_cipher_token(request_csrf_token),
        _unsalt_cipher_token(csrf_token),
    ) </s> remove    when using a session independent nonce, due to the fact that HTTP
 </s> add    when using a session independent secret, due to the fact that HTTP </s> remove 1. A CSRF cookie that is set to a random value (a session independent nonce, as
   it is called), which other sites will not have access to.
 </s> add 1. A CSRF cookie that is based on a random secret value, which other sites
   will not have access to.
                # secret we're using. So the MITM can circumvent the CSRF
                  # submits it via JavaScript.
                  #
                  # The attacker will need to provide a CSRF cookie and token, but
                  # that's no problem for a MITM and the session-independent
                # secret we're using. So the MITM can circumvent the CSRF
                  # protection. This is true for any HTTP connection, but anyone
                  # using HTTPS expects better! For this reason, for
                  # https://example.com/ we need additional protection that treats
                  # http://example.com/ as completely untrusted. Under HTTPS,
                  # Barth et al. found that the Referer header is missing for
keep keep keep keep replace keep keep keep keep keep
 Fixed #20869 -- made CSRF tokens change every request by salt-encrypting them

Note that the cookie is not changed every request, just the token retrieved
by the `get_token()` method (used also by the `{% csrf_token %}` tag).

While at it, made token validation strict: Where, before, any length was
accepted and non-ASCII chars were ignored, we now treat anything other than
`[A-Za-z0-9]{64}` as invalid (except for 32-char tokens, which, for
backwards-compatibility, are accepted and replaced by 64-char ones).

Thanks Trac user patrys for reporting, github user adambrenecki
for initial patch, Tim Graham for help, and Curtis Maloney,
Collin Anderson, Florian Apolloner, Markus Holtermann & Jon Dufresne
for reviews. 
django/middleware/csrf.py