is a hashed uuid4 a good csrf token?

Question

Is this a good csrf token? Does it have enough entropy, or are there parts that are easily guessable and could reduce the entropy, like the time of the request?

An example python implementation would b

token = hashlib.sha256(str(uuid.uuid4())).hexdigest()

Answer 1

uuid v4 has 122 random bits (of a possible 128) so, yes, it should be fine as a CSRF token.

(BTW, does hashing this accomplish anything? It's not really doing much other than shuffling random bits around.)