What’s new in Tornado 3.2.2¶
June 3, 2014¶
The XSRF token is now encoded with a random mask on each request. This makes it safe to include in compressed pages without being vulnerable to the BREACH attack. This applies to most applications that use both the
gzipoptions (or have gzip applied by a proxy).
If Tornado 3.2.2 is run at the same time as older versions on the same domain, there is some potential for issues with the differing cookie versions. The
xsrf_cookie_version=1can be used for a transitional period to generate the older cookie format on newer servers.
tornado.platform.asynciois now compatible with