"there is no server-side state that the attacker has to guess" That part is certainly true when django isn't using sessions. I think that in normal use the to

"there is no server-side state that the attacker has to guess" That part is certainly true when django isn't using sessions. I think that in normal use the tokens are still always generated on the server, not the client, though. The problem is that like you said, there is no way to validate that without some server state, so even though the server is expected to have generated the token, it can't distinguish and invalidate a token generated by anyone else as long as it's in the correct format.