diff options
| author | Paul McMillan <Paul@McMillan.ws> | 2011-11-21 22:03:03 +0000 |
|---|---|---|
| committer | Paul McMillan <Paul@McMillan.ws> | 2011-11-21 22:03:03 +0000 |
| commit | 4d975b4f882eb2a68da02e069aa1debb99073497 (patch) | |
| tree | 00ef324a8e80042accaf05fd122cf03c60ce0740 /docs/releases | |
| parent | 43c5d35315299330aaca1e2aab6fd2548eff7fcb (diff) | |
Fixed #16847. Session Cookies now default to httponly = True.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17135 bcc190cf-cafb-0310-a4f2-bffc1f526a37
Diffstat (limited to 'docs/releases')
| -rw-r--r-- | docs/releases/1.4.txt | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/docs/releases/1.4.txt b/docs/releases/1.4.txt index 46527da581..b611626099 100644 --- a/docs/releases/1.4.txt +++ b/docs/releases/1.4.txt @@ -451,10 +451,10 @@ Minor features Django 1.4 also includes several smaller improvements worth noting: -* A more usable stacktrace in the technical 500 page: frames in the stack - trace which reference Django's code are dimmed out, while frames in user - code are slightly emphasized. This change makes it easier to scan a stacktrace - for issues in user code. +* A more usable stacktrace in the technical 500 page: frames in the + stack trace which reference Django's code are dimmed out, while + frames in user code are slightly emphasized. This change makes it + easier to scan a stacktrace for issues in user code. * :doc:`Tablespace support </topics/db/tablespaces>` in PostgreSQL. @@ -498,6 +498,9 @@ Django 1.4 also includes several smaller improvements worth noting: * Added the :djadminopt:`--no-location` option to the :djadmin:`makemessages` command. +* Changed the default value for ``httponly`` on session cookies to + ``True`` to help reduce the impact of potential XSS attacks. + .. _backwards-incompatible-changes-1.4: Backwards incompatible changes in 1.4 |