| What's new in Tornado 1.1.1 |
| =========================== |
| |
| Feb 8, 2011 |
| ----------- |
| |
| :: |
| |
| Tornado 1.1.1 is a BACKWARDS-INCOMPATIBLE security update that fixes an |
| XSRF vulnerability. It is available at |
| http://github.com/downloads/facebook/tornado/tornado-1.1.1.tar.gz |
| |
| This is a backwards-incompatible change. Applications that previously |
| relied on a blanket exception for XMLHTTPRequest may need to be modified |
| to explicitly include the XSRF token when making ajax requests. |
| |
| The tornado chat demo application demonstrates one way of adding this |
| token (specifically the function postJSON in demos/chat/static/chat.js). |
| |
| More information about this change and its justification can be found at |
| http://www.djangoproject.com/weblog/2011/feb/08/security/ |
| http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails |
