     For security reasons, the value of the CSRF cookie is changed each time a
     user logs in.
  
  2. A hidden form field with the name 'csrfmiddlewaretoken' present in all
     outgoing POST forms.  The value of this field is the value of the CSRF
     cookie.
  
     This part is done by the template tag.
  
  3. For all incoming requests that are not using HTTP GET, HEAD, OPTIONS or
     TRACE, a CSRF cookie must be present, and the 'csrfmiddlewaretoken' field
 
</s> remove    For security reasons, the value of the CSRF cookie is changed each time a
 </s> add    In order to protect against `BREACH`_ attacks, the token is not simply the
   secret; a random salt is prepended to the secret and used to scramble it.

   For security reasons, the value of the secret is changed each time a </s> remove    This cookie is set by ``CsrfViewMiddleware``.  It is meant to be permanent,
   but since there is no way to set a cookie that never expires, it is sent with
   every response that has called ``django.middleware.csrf.get_token()``
   (the function used internally to retrieve the CSRF token).
 </s> add    This cookie is set by ``CsrfViewMiddleware``. It is sent with every
   response that has called ``django.middleware.csrf.get_token()`` (the
   function used internally to retrieve the CSRF token), if it wasn't already
   set on the request. </s> remove Why not use a new token for each request?
-----------------------------------------

Generating a new token for each request is problematic from a UI perspective
because it invalidates all previous forms. Most users would be very unhappy to
find that opening a new tab on your site has invalidated the form they had
just spent time filling out in another tab or that a form they accessed via
the back button could not be filled out.

 </s> add  </s> remove 1. A CSRF cookie that is set to a random value (a session independent nonce, as
   it is called), which other sites will not have access to.
 </s> add 1. A CSRF cookie that is based on a random secret value, which other sites
   will not have access to.
   outgoing POST forms. The value of this field is, again, the value of the
   secret, with a salt which is both added to it and used to scramble it. The
   salt is regenerated on every call to ``get_token()`` so that the form field
   value is changed in every such response.
     For security reasons, the value of the CSRF cookie is changed each time a
     user logs in.
  
  2. A hidden form field with the name 'csrfmiddlewaretoken' present in all
   outgoing POST forms. The value of this field is, again, the value of the
   secret, with a salt which is both added to it and used to scramble it. The
   salt is regenerated on every call to ``get_token()`` so that the form field
   value is changed in every such response.
   outgoing POST forms. The value of this field is, again, the value of the
   secret, with a salt which is both added to it and used to scramble it. The
   salt is regenerated on every call to ``get_token()`` so that the form field
   value is changed in every such response.
  
     This part is done by the template tag.
  
  3. For all incoming requests that are not using HTTP GET, HEAD, OPTIONS or
     TRACE, a CSRF cookie must be present, and the 'csrfmiddlewaretoken' field
keep keep keep keep replace replace keep keep keep keep keep
 Fixed #20869 -- made CSRF tokens change every request by salt-encrypting them

Note that the cookie is not changed every request, just the token retrieved
by the `get_token()` method (used also by the `{% csrf_token %}` tag).

While at it, made token validation strict: Where, before, any length was
accepted and non-ASCII chars were ignored, we now treat anything other than
`[A-Za-z0-9]{64}` as invalid (except for 32-char tokens, which, for
backwards-compatibility, are accepted and replaced by 64-char ones).

Thanks Trac user patrys for reporting, github user adambrenecki
for initial patch, Tim Graham for help, and Curtis Maloney,
Collin Anderson, Florian Apolloner, Markus Holtermann & Jon Dufresne
for reviews. 
docs/ref/csrf.txt