From: Ben Darnell Date: Mon, 27 Jun 2011 01:32:41 +0000 (-0700) Subject: Remove support for cookies set by pre-1.0 releases of Tornado. X-Git-Tag: v2.1.0~142 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5d36a5d9533cb600a1575e5f0ecc6cbd11ddd88f;p=thirdparty%2Ftornado.git Remove support for cookies set by pre-1.0 releases of Tornado. --- diff --git a/tornado/web.py b/tornado/web.py index 821af91e8..485f29205 100644 --- a/tornado/web.py +++ b/tornado/web.py @@ -370,25 +370,13 @@ class RequestHandler(object): value = b("|").join([value, timestamp, signature]) return value - def get_secure_cookie(self, name, include_name=True, value=None, - max_age_days=31): - """Returns the given signed cookie if it validates, or None. - - In older versions of Tornado (0.1 and 0.2), we did not include the - name of the cookie in the cookie signature. To read these old-style - cookies, pass include_name=False to this method. Otherwise, all - attempts to read old-style cookies will fail (and you may log all - your users out whose cookies were written with a previous Tornado - version). - """ + def get_secure_cookie(self, name, value=None, max_age_days=31): + """Returns the given signed cookie if it validates, or None.""" if value is None: value = self.get_cookie(name) if not value: return None parts = utf8(value).split(b("|")) if len(parts) != 3: return None - if include_name: - signature = self._cookie_signature(name, parts[0], parts[1]) - else: - signature = self._cookie_signature(parts[0], parts[1]) + signature = self._cookie_signature(name, parts[0], parts[1]) if not _time_independent_equals(parts[2], signature): logging.warning("Invalid cookie signature %r", value) return None diff --git a/website/sphinx/releases/next.rst b/website/sphinx/releases/next.rst index b97b0fb23..22735cd3d 100644 --- a/website/sphinx/releases/next.rst +++ b/website/sphinx/releases/next.rst @@ -4,6 +4,13 @@ What's new in the next release of Tornado In progress ----------- +Backwards-incompatible changes +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +* Support for secure cookies written by pre-1.0 releases of Tornado has + been removed. The `RequestHandler.get_secure_cookie` method no longer + takes an ``include_name`` parameter. + New features ~~~~~~~~~~~~