  
      Checking against the :setting:`CSRF_COOKIE_DOMAIN` setting was added.
  
  Caching
  =======
  
  If the :ttag:`csrf_token` template tag is used by a template (or the
  ``get_token`` function is called some other way), ``CsrfViewMiddleware`` will
 
</s> remove    This cookie is set by ``CsrfViewMiddleware``.  It is meant to be permanent,
   but since there is no way to set a cookie that never expires, it is sent with
   every response that has called ``django.middleware.csrf.get_token()``
   (the function used internally to retrieve the CSRF token).
 </s> add    This cookie is set by ``CsrfViewMiddleware``. It is sent with every
   response that has called ``django.middleware.csrf.get_token()`` (the
   function used internally to retrieve the CSRF token), if it wasn't already
   set on the request. </s> remove 1. A CSRF cookie that is set to a random value (a session independent nonce, as
   it is called), which other sites will not have access to.
 </s> add 1. A CSRF cookie that is based on a random secret value, which other sites
   will not have access to. </s> remove    For security reasons, the value of the CSRF cookie is changed each time a
 </s> add    In order to protect against `BREACH`_ attacks, the token is not simply the
   secret; a random salt is prepended to the secret and used to scramble it.

   For security reasons, the value of the secret is changed each time a </s> remove    outgoing POST forms.  The value of this field is the value of the CSRF
   cookie.
 </s> add    outgoing POST forms. The value of this field is, again, the value of the
   secret, with a salt which is both added to it and used to scramble it. The
   salt is regenerated on every call to ``get_token()`` so that the form field
   value is changed in every such response.
.. versionchanged:: 1.10

   Added salting to the token and started changing it with each request
   to protect against `BREACH`_ attacks.

.. _BREACH: http://breachattack.com/

  
      Checking against the :setting:`CSRF_COOKIE_DOMAIN` setting was added.
  
.. versionchanged:: 1.10

   Added salting to the token and started changing it with each request
   to protect against `BREACH`_ attacks.

.. _BREACH: http://breachattack.com/

  Caching
  =======
  
  If the :ttag:`csrf_token` template tag is used by a template (or the
  ``get_token`` function is called some other way), ``CsrfViewMiddleware`` will
keep keep add keep keep keep keep keep
 Fixed #20869 -- made CSRF tokens change every request by salt-encrypting them

Note that the cookie is not changed every request, just the token retrieved
by the `get_token()` method (used also by the `{% csrf_token %}` tag).

While at it, made token validation strict: Where, before, any length was
accepted and non-ASCII chars were ignored, we now treat anything other than
`[A-Za-z0-9]{64}` as invalid (except for 32-char tokens, which, for
backwards-compatibility, are accepted and replaced by 64-char ones).

Thanks Trac user patrys for reporting, github user adambrenecki
for initial patch, Tim Graham for help, and Curtis Maloney,
Collin Anderson, Florian Apolloner, Markus Holtermann & Jon Dufresne
for reviews. 
docs/ref/csrf.txt