Yeah turning off compression completely is kind of crude but it works without having to go into app-specifics, I'm sure the Django folks are on it ;). When it c

Yeah turning off compression completely is kind of crude but it works without having to go into app-specifics, I'm sure the Django folks are on it ;). When it comes to things like CSRF tokens, probably secret masking (4) is the easiest to implement? so something like import uuid csrf = '42be455e20e64d7294eee8d1806d14a9' p = uuid.uuid4().hex # random response-specific pad xord = "%2x" % (int(csrf, 16) ^ int(p,16)) request_token = "%s%s" % (p, xord) print "<input type='hidden' name='token' value='%s'>" % request_token v_unxord = "%2x" % (int(request_token[len(request_token)/2:], 16) ^ int(request_token[:len(request_token)/2], 16)) if ( v_unxord == csrf ): print "yay, valid CSRF" # constant_time_cmp