Django web framework uses the Double Submit Cookie pattern for CSRF protection. (The CSRF token is sent in a cookie and also in a hidden form field. Incoming requests are checked for a match between the token in the cookie and the token in the form field. A CSRF attacker can send a request with the correct cookie, but not the correct form field.)
To generate these two tokens, two identical secrets are salted with different salts, which are included in the tokens. This pattern is stateless on the server, so nothing is stored server side. What is the point of salting the secrets?
If an attacker can read any of the tokens, they can also unsalt them (provided they know what algorithm is used, which they can figure out).
CSRF_ALLOWED_CHARS = string.ascii_letters + string.digits def _unsalt_cipher_token(token): """ Given a token (assumed to be a string of CSRF_ALLOWED_CHARS, of length CSRF_TOKEN_LENGTH, and that its first half is a salt), use it to decrypt the second half to produce the original secret. """ salt = token[:CSRF_SECRET_LENGTH] token = token[CSRF_SECRET_LENGTH:] chars = CSRF_ALLOWED_CHARS pairs = zip((chars.index(x) for x in token), (chars.index(x) for x in salt)) return ''.join(chars[x - y] for x, y in pairs) # Note negative values are ok
This is also doesn't seem to protect against some of the vulnerabilities like when an attacker overwrites the cookie from a subdomain or as a man in the middle.