Index: django/test/client.py
===================================================================
--- django/test/client.py	(revision 9084)
+++ django/test/client.py	(working copy)
@@ -18,6 +18,7 @@
 from django.utils.encoding import smart_str
 from django.utils.http import urlencode
 from django.utils.itercompat import is_iterable
+from django.contrib.csrf.middleware import CSRF_TOKEN_NAME, _make_token
 
 BOUNDARY = 'BoUnDaRyStRiNg'
 MULTIPART_CONTENT = 'multipart/form-data; boundary=%s' % BOUNDARY
@@ -268,6 +269,11 @@
         """
         Requests a response from the server using POST.
         """
+        if ('django.contrib.csrf.middleware.CsrfMiddleware' in
+            settings.MIDDLEWARE_CLASSES and
+            hasattr(self.session, 'session_key')):
+            data[CSRF_TOKEN_NAME] = _make_token(self.session.session_key)
+            
         if content_type is MULTIPART_CONTENT:
             post_data = encode_multipart(BOUNDARY, data)
         else:
Index: django/contrib/csrf/middleware.py
===================================================================
--- django/contrib/csrf/middleware.py	(revision 9084)
+++ django/contrib/csrf/middleware.py	(working copy)
@@ -13,6 +13,8 @@
 from django.utils.hashcompat import md5_constructor
 from django.utils.safestring import mark_safe
 
+CSRF_TOKEN_NAME = 'csrfmiddlewaretoken'
+
 _ERROR_MSG = mark_safe('<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><body><h1>403 Forbidden</h1><p>Cross Site Request Forgery detected. Request aborted.</p></body></html>')
 
 _POST_FORM_RE = \
@@ -52,7 +54,7 @@
             csrf_token = _make_token(session_id)
             # check incoming token
             try:
-                request_csrf_token = request.POST['csrfmiddlewaretoken']
+                request_csrf_token = request.POST[CSRF_TOKEN_NAME]
             except KeyError:
                 return HttpResponseForbidden(_ERROR_MSG)
 
@@ -80,13 +82,13 @@
                 response['Content-Type'].split(';')[0] in _HTML_TYPES:
 
             # ensure we don't add the 'id' attribute twice (HTML validity)
-            idattributes = itertools.chain(("id='csrfmiddlewaretoken'",),
+            idattributes = itertools.chain(("id='%s'" % (CSRF_TOKEN_NAME,),),
                                             itertools.repeat(''))
             def add_csrf_field(match):
                 """Returns the matched <form> tag plus the added <input> element"""
                 return mark_safe(match.group() + "<div style='display:none;'>" + \
                 "<input type='hidden' " + idattributes.next() + \
-                " name='csrfmiddlewaretoken' value='" + csrf_token + \
+                " name='" + CSRF_TOKEN_NAME + "' value='" + csrf_token + \
                 "' /></div>")
 
             # Modify any POST forms
Index: tests/regressiontests/test_client_regress/models.py
===================================================================
--- tests/regressiontests/test_client_regress/models.py	(revision 9084)
+++ tests/regressiontests/test_client_regress/models.py	(working copy)
@@ -382,4 +382,35 @@
         response = self.client.get('/test_client_regress/check_session/')
         self.assertEqual(response.status_code, 200)
         self.assertEqual(response.content, 'YES')
-        
\ No newline at end of file
+
+class CsrfMiddlewareAvoidanceTests(TestCase):
+    fixtures = ['testdata.json']
+
+    def setUp(self):
+        self.old_middleware_classes = settings.MIDDLEWARE_CLASSES
+        settings.MIDDLEWARE_CLASSES = (
+            'django.contrib.csrf.middleware.CsrfMiddleware',
+            'django.contrib.sessions.middleware.SessionMiddleware',
+            'django.contrib.auth.middleware.AuthenticationMiddleware',
+            'django.middleware.common.CommonMiddleware',
+            )
+
+    def tearDown(self):
+        settings.MIDDLEWARE_CLASSES = self.old_middleware_classes
+
+    def test_circumvent_csrf_middleware(self):
+        # Csrf middleware only activates if there is a session
+        login = self.client.login(username='testclient',password='password')
+        self.failUnless(login, 'Could not log in')
+
+        response = self.client.post('/test_client_regress/no_template_view/',
+                                    {'some': 'post data'})
+
+        # if we'd gotten caught by CsrfMiddleware, we'd get a 403
+        self.assertEqual(response.status_code, 200)
+        self.client.logout()
+
+    def test_logged_out_post_still_works(self):
+        response = self.client.post('/test_client_regress/no_template_view/',
+                                    {'some': 'post data'})
+        self.assertEqual(response.status_code, 200)
Index: docs/ref/contrib/csrf.txt
===================================================================
--- docs/ref/contrib/csrf.txt	(revision 9084)
+++ docs/ref/contrib/csrf.txt	(working copy)
@@ -73,4 +73,10 @@
 you might bypass the filter that adds the hidden field to the form,
 in which case form submission will always fail.  It may still be possible
 to use the middleware, provided you can find some way to get the
-CSRF token and ensure that is included when your form is submitted.
\ No newline at end of file
+CSRF token and ensure that is included when your form is submitted.
+
+Testing
+=======
+
+The :mod:`Django test client <django.test.client>` automatically
+bypasses CsrfMiddleware, for easier testing of POST requests.
