title: What's the relationship between csrfmiddlewaretoken and csrftoken?
body: <p>I was working with Django to create a website and got some questions about CSRF. I use <code>django.middleware.csrf.CsrfViewMiddleware</code> and add <code>&lt;form action="" method="post"&gt;{% csrf_token %}</code> in my POST form.  </p>
  
  <p>And when I test the website:</p>
  
  <pre><code>GET / HTTP/1.1
  Host: 123.207.137.168:8000
  </code></pre>
  
  <p>Then, I got cookies </p>
  
  <pre><code>Set-Cookie:csrftoken=Ev8veOH89vFDnG3a0GJUsMXA1oGZXxqXRw2nFWiKrvZ9UE10niTlZCiOxdnoKfTv; expires=Thu, 27-Dec-2018 06:37:41 GMT; Max-Age=31449600; Path=/
  </code></pre>
  
  <p>But in the html:</p>
  
  <pre><code>&lt;input type='hidden' name='csrfmiddlewaretoken' value='JswHLk4fNpxHkh0OObD1uKiOxSDUzkMDWtqzcsFR5pRdRfYEbNNs1AD23Hkjm2fb' /&gt;
  </code></pre>
  
  <p>So I was wondering why the <code>csrftoken</code> and <code>csrfmiddlewaretoken</code> is different and how did the server use these two value to valid if the request is from the users or hackers?</p>
  
  <hr>