Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Fetching contributors…

Cannot retrieve contributors at this time

29 lines (21 sloc) 0.92 kb

What's new in Tornado 3.2.2

June 3, 2014

Security fixes

  • The XSRF token is now encoded with a random mask on each request. This makes it safe to include in compressed pages without being vulnerable to the BREACH attack. This applies to most applications that use both the xsrf_cookies and gzip options (or have gzip applied by a proxy).

Backwards-compatibility notes

  • If Tornado 3.2.2 is run at the same time as older versions on the same domain, there is some potential for issues with the differing cookie versions. The .Application setting xsrf_cookie_version=1 can be used for a transitional period to generate the older cookie format on newer servers.

Other changes

  • tornado.platform.asyncio is now compatible with trollius version 0.3.
Jump to Line
Something went wrong with that request. Please try again.