Avoid CSRF token discovery via BREACH attack by masking with a random value

Patch for [ticket 20869 in trac](https://code.djangoproject.com/ticket/20869), using the same approach as the Rails patch mentioned in the first comment there.

Avoids CSRF token discovery via BREACH by XORing the token in the body with a value generated anew each request (actually, each time `get_token` is called) & storing said value alongside it.
My question would be: do you need to define a set of allowed characters?
Does not just base64 encoding (with the URL-safe character set) the output
of secure random not achieve the same goal?


On Mon, Aug 4, 2014 at 9:52 AM, Curtis Maloney <notifications@github.com>
wrote:

> In django/middleware/csrf.py:
>
> > @@ -25,6 +25,7 @@
> >  REASON_BAD_TOKEN = "CSRF token missing or incorrect."
> >
> >  CSRF_KEY_LENGTH = 32
> > +VALID_CHARS = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'
>
> This same set of chars is defined in django.utils.crypto as the default
> for "allowed_chars" for the get_random_string function.
>
> Should we consider making this a more accessible constant?
>
> —
> Reply to this email directly or view it on GitHub
> <https://github.com/django/django/pull/1477/files#r15738414>.
>