The masking is needed to avoid the BREACH attack, a variant of the CRIME compression attack. CRIME was an attack on compressed headers and was fixed in HTTP2 with the HPACK algorithm which compresses headers in such a way that they are not vulnerable. Unfortunately the CSRF token is present in the body and does not change between requests, meaning it can slowly be revealed if an attacker can tweak the page contents and observe the compression ratio.
Masking literally just generates another token’s worth of bytes as a mask, xors that with the token, and returns the concatenation of the two. This essentially hides (masks) the original token from the compression algorithm, and the mask changes on every request so it cannot be iteratively revealed.
Personally I find the complexity (and therefore bug surface) of CSRF protection quite distressing given that experts believe the token approach is no longer necessary. But of course this is brand new guidance and it will take time for everyone to adapt.
