2011-06-12 04:32:45 +00:00
|
|
|
What's new in Tornado 1.1.1
|
|
|
|
|
===========================
|
|
|
|
|
|
|
|
|
|
Feb 8, 2011
|
|
|
|
|
-----------
|
|
|
|
|
|
|
|
|
|
::
|
2012-06-04 00:37:36 +00:00
|
|
|
|
2011-06-12 04:32:45 +00:00
|
|
|
Tornado 1.1.1 is a BACKWARDS-INCOMPATIBLE security update that fixes an
|
|
|
|
|
XSRF vulnerability. It is available at
|
2012-06-04 00:37:36 +00:00
|
|
|
https://github.com/downloads/facebook/tornado/tornado-1.1.1.tar.gz
|
|
|
|
|
|
2011-06-12 04:32:45 +00:00
|
|
|
This is a backwards-incompatible change. Applications that previously
|
|
|
|
|
relied on a blanket exception for XMLHTTPRequest may need to be modified
|
|
|
|
|
to explicitly include the XSRF token when making ajax requests.
|
2012-06-04 00:37:36 +00:00
|
|
|
|
2011-06-12 04:32:45 +00:00
|
|
|
The tornado chat demo application demonstrates one way of adding this
|
|
|
|
|
token (specifically the function postJSON in demos/chat/static/chat.js).
|
2012-06-04 00:37:36 +00:00
|
|
|
|
2011-06-12 04:32:45 +00:00
|
|
|
More information about this change and its justification can be found at
|
|
|
|
|
http://www.djangoproject.com/weblog/2011/feb/08/security/
|
|
|
|
|
http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails
|
