diff --git a/django/middleware/csrf.py b/django/middleware/csrf.py
index 37f92b1..fb2dbde 100644
--- a/django/middleware/csrf.py
+++ b/django/middleware/csrf.py
@@ -25,6 +25,8 @@ else:
     randrange = random.randrange
 _MAX_CSRF_KEY = 18446744073709551616L     # 2 << 63
 
+CSRF_KEY_LENGTH = 32 # implied from using MD5 hash
+
 REASON_NO_REFERER = "Referer checking failed - no Referer."
 REASON_BAD_REFERER = "Referer checking failed - %s does not match %s."
 REASON_NO_CSRF_COOKIE = "CSRF cookie not set."
@@ -59,7 +61,10 @@ def get_token(request):
 def _sanitize_token(token):
     # Allow only alphanum, and ensure we return a 'str' for the sake of the post
     # processing middleware.
-    token = re.sub('[^a-zA-Z0-9]', '', str(token.decode('ascii', 'ignore')))
+    if len(token) >= CSRF_KEY_LENGTH:
+        token = ""
+    else:
+        token = re.sub('[^a-zA-Z0-9]', '', str(token.decode('ascii', 'ignore')))
     if token == "":
         # In case the cookie has been truncated to nothing at some point.
         return _get_new_csrf_key()
diff --git a/tests/regressiontests/csrf_tests/tests.py b/tests/regressiontests/csrf_tests/tests.py
index 6e6c87a..07bbfdb 100644
--- a/tests/regressiontests/csrf_tests/tests.py
+++ b/tests/regressiontests/csrf_tests/tests.py
@@ -4,7 +4,7 @@ from __future__ import with_statement
 from django.conf import settings
 from django.core.context_processors import csrf
 from django.http import HttpRequest, HttpResponse
-from django.middleware.csrf import CsrfViewMiddleware
+from django.middleware.csrf import CsrfViewMiddleware, CSRF_KEY_LENGTH
 from django.template import RequestContext, Template
 from django.test import TestCase
 from django.views.decorators.csrf import csrf_exempt, requires_csrf_token, ensure_csrf_cookie
@@ -100,6 +100,19 @@ class CsrfViewMiddlewareTest(TestCase):
         self.assertEqual(csrf_cookie['path'], '/test/')
         self.assertTrue('Cookie' in resp2.get('Vary',''))
 
+    def test_process_view_token_too_long(self):
+        u"""
+        Check that if the token is longer than expected, it is ignored and
+        a new token is created.
+        """
+        req = self._get_GET_no_csrf_cookie_request()
+        req.COOKIES[settings.CSRF_COOKIE_NAME] = 'x' * 10000000
+        CsrfViewMiddleware().process_view(req, token_view, (), {})
+        resp = token_view(req)
+        resp2 = CsrfViewMiddleware().process_response(req, resp)
+        csrf_cookie = resp2.cookies.get(settings.CSRF_COOKIE_NAME, False)
+        self.assertEqual(len(csrf_cookie.value), CSRF_KEY_LENGTH)
+
     def test_process_response_get_token_not_used(self):
         """
         Check that if get_token() is not called, the view middleware does not