Commits on Feb 1, 2023

1. web: Deprecate xsrf_cookies (and xsrf_token, etc) …

   This feature is more invasive than using the samesite cookie attribute
   but does not provide additional protection, so it is no longer
   something that we should recommend.
   
   Now that this feature is deprecated, the open issues related to it
   will not be fixed (however, I intend to keep the current code around
   indefinitely; there are no plans to remove it).
   
   Closes tornadoweb#865
   Closes tornadoweb#2573
   Closes tornadoweb#3026

   

   bdarnell committed Feb 1, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for 0558518
   • Browse repository at this point

   Copy the full SHA

   0558518 View commit details

   Browse the repository at this point in the history

2. web: Support "name" in xsrf_cookie_kwargs …

   This small new functionality in a deprecated feature may provide
   a higher level of security; if this turns out to be useful in practice
   we may un-deprecate the xsrf_cookies feature.

   

   bdarnell committed Feb 1, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for 1dd77a8
   • Browse repository at this point

   Copy the full SHA

   1dd77a8 View commit details

   Browse the repository at this point in the history

3. demos: lint fixes

   

   bdarnell committed Feb 1, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for 6c37366
   • Browse repository at this point

   Copy the full SHA

   6c37366 View commit details

   Browse the repository at this point in the history

4. web: More cookie doc updates.

   

   bdarnell committed Feb 1, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for dfd205e
   • Browse repository at this point

   Copy the full SHA

   dfd205e View commit details

   Browse the repository at this point in the history