v3.2.1 release notes

diff --git a/docs/releases.rst b/docs/releases.rst
index a4d12a703ebdcc6caea02f95d1aaeafe3234a0bb..dd39af90a22711f899c29e9440b44685275a74bc 100644 (file)
--- a/docs/releases.rst
+++ b/docs/releases.rst
@@ -4,6 +4,7 @@ Release notes
 .. toctree::
    :maxdepth: 2
 
+   releases/v3.2.1
    releases/v3.2.0
    releases/v3.1.1
    releases/v3.1.0

diff --git a/docs/releases/v3.2.1.rst b/docs/releases/v3.2.1.rst
new file mode 100644 (file)
index 0000000..b636411
--- /dev/null
+++ b/docs/releases/v3.2.1.rst
@@ -0,0 +1,39 @@
+What's new in Tornado 3.2.1
+===========================
+
+May 5, 2014
+-----------
+
+Security fixes
+~~~~~~~~~~~~~~
+
+* The signed-value format used by `.RequestHandler.set_secure_cookie`
+  and `.RequestHandler.get_secure_cookie` has changed to be more secure.
+  **This is a disruptive change**.  The ``secure_cookie`` functions
+  take new ``version`` parameters to support transitions between cookie
+  formats.
+* The new cookie format fixes a vulnerability that may be present in
+  applications that use multiple cookies where the name of one cookie
+  is a prefix of the name of another.
+* To minimize disruption, cookies in the older format will be accepted
+  by default until they expire.  Applications that may be vulnerable
+  can reject all cookies in the older format by passing ``min_version=2``
+  to `.RequestHandler.get_secure_cookie`.
+
+Backwards-compatibility notes
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+* Signed cookies issued by `.RequestHandler.set_secure_cookie` in Tornado
+  3.2.1 cannot be read by older releases.  If you need to run 3.2.1
+  in parallel with older releases, you can pass ``version=1`` to
+  `.RequestHandler.set_secure_cookie` to issue cookies that are
+  backwards-compatible (but have a known weakness, so this option
+  should only be used for a transitional period).
+
+Other changes
+~~~~~~~~~~~~~
+
+* The C extension used to speed up the websocket module now compiles
+  correctly on Windows with MSVC and 64-bit mode.  The fallback to
+  the pure-Python alternative now works correctly on Mac OS X machines
+  with no C compiler installed.