scjody/django-session-csrf — comment on commit 4b92d9d2c6fd6faeb3c35b3b7766272b4cffa4e9
File:  line 0
By jbalogh:

I'm not good at thinking about vulnerabilities, but I don't think we want to do this. If some pieces of your stack are relying on an insecure token then you're opening yourself up to attacks. Any thoughts @mcoates?

1. Attacker sets CSRF_COOKIE to the attacker's csrf token through subdomain hack.
2. Attacker gets user to submit sensitive value through ajax/web service to his account.
3. Attacker can see your data.