* Support for secure cookies written by pre-1.0 releases of Tornado has

takes an ``include_name`` parameter.

* The ``debug`` application setting now causes stack traces to be displayed

in the browser on uncaught exceptions. Since this may leak sensitive

* Diginotar has been removed from the default CA certificates file used

New modules

* `tornado.process`: Multi-process mode has been improved, and can now restart

crashed child processes. A new entry point has been added at

`tornado.process.fork_processes`, although

``tornado.web``

argument to set the ``max-age`` cookie attribute (note underscore vs dash)

* `tornado.web.RequestHandler.set_default_headers` may be overridden to set

headers in a way that does not get reset during error handling.

appear multiple times in the response.

* The ``application/json`` content type can now be gzipped.

* The cookie-signing functions are now accessible as static functions

``tornado.httpserver``

* The ``cookies`` property is now available on `tornado.httpserver.HTTPRequest`

(it is also available in its old location as a property of

`~tornado.web.RequestHandler`)

same meaning as ``socket.listen``.

* `~tornado.httpserver.HTTPServer` can now be run on a unix socket as well

as TCP.

* `~tornado.iostream.IOStream` performance has been improved, especially for

small synchronous requests.

``streaming_callback`` argument to return data as it is received rather

than all at once.

to absolute timestamps.

* `~tornado.ioloop.PeriodicCallback` now sticks to the specified period

instead of creeping later due to accumulated errors.

* `tornado.ioloop.IOLoop` and `tornado.httpclient.HTTPClient` now have

``close()`` methods that should be used in applications that create

and destroy many of these objects.

as the singleton without monkey-patching.

* `~tornado.iostream.IOStream` should now always call the close callback

instead of the connect callback on a connection error.

are pending read callbacks that can be satisfied with buffered data.

* The ``allow_nonstandard_methods`` flag on HTTP client requests now

permits methods other than ``POST`` and ``PUT`` to contain bodies.

* Fixed file descriptor leaks and multiple callback invocations in

* No longer consumes extra connection resources when following redirects.

* Now works with buggy web servers that separate headers with ``\n`` instead

of ``\r\n\r\n``.

Other modules

callback URI is on a different domain.

* `tornado.autoreload` has a new command-line interface which can be used

to wrap any script. This replaces the ``--autoreload`` argument to

`tornado.testing.main` and is more robust against syntax errors.

* `tornado.autoreload.watch` can be used to watch files other than

the sources of imported modules.

``executemany`` that return the number of rows affected instead of

the last inserted row id.

* `tornado.locale.load_translations` now accepts any properly-formatted

and unquoted.

* Multi-line headers are now supported.

* Repeated Content-Length headers (which may be added by certain proxies)

* Unicode string literals now work in template expressions.

* The template ``{% module %}`` directive now works even if applications

use a template variable named ``modules``.

Security fixes

SSLv2 would be allowed if the Python interpreter was linked against a

pre-1.0 version of OpenSSL.

processes exit cleanly rather than returning ``None``. The old behavior

was surprising and inconsistent with most of the documented examples

of this function (which did not check the return value).

is because Python 2.6 does not expose a way to support both SSLv3 and TLSv1

without also supporting the insecure SSLv2.

* `tornado.websocket` no longer supports the older "draft 76" version

``tornado.httpclient``

responses with no content, or empty ``POST``/``PUT`` response bodies.

empty password.

``tornado.httpserver``

``X-Real-IP`` headers that don't look like valid IP addresses.

case-insensitive.

``tornado.ioloop`` and ``tornado.iostream``

when there is a lot of buffered data, which improves peformance of

chunks.

a value other than ``SSLv23``.

* Idle ``IOLoops`` no longer wake up several times a second.

* `tornado.ioloop.PeriodicCallback` no longer triggers duplicate callbacks

* Now behaves better when given malformed ``Cookie`` headers

status codes other than 301 and 302.

on ``HEAD`` requests.

``parse_url_path`` methods for use in subclasses.

attribute).

``tornado.websocket``

* `tornado.websocket` no longer supports the older "draft 76" version

of the websocket protocol by default, although this version can

be enabled by overriding `tornado.websocket.WebSocketHandler.allow_draft76`.

to send binary messages.

* Subprotocols (i.e. the ``Sec-WebSocket-Protocol`` header) are now supported;

appropriate url scheme (``ws://`` or ``wss://``) in cases where

Other modules

* `tornado.testing.main` supports a new flag ``--exception_on_interrupt``,

which can be set to false to make ``Ctrl-C`` kill the process more

reliably (at the expense of stack traces when it does so).

distinguished from development branches.

values to protect against header injection, response splitting, etc.

(it has always attempted to do this, but the check was incorrect).

Note that redirects, the most likely source of such bugs, are protected

Bug fixes

* `tornado.httpclient.HTTPClient` now supports the same constructor

HTTP methods.

instead of leaving them for garbage collection.

URLs containing IPv6 literals (This bug affected Python 2.5 and 2.6).

in the ``Host`` header when those credentials are extracted from the URL.

dictionary, which caused problems when following redirects.

the same ``client_cert`` and ``client_key`` arguments as

HTTP Server

(fake data is used for non-IP sockets)

* Extra data at the end of multipart form bodies is now ignored, which fixes

a compatibility problem with an iOS HTTP client library.

``IOLoop`` and ``IOStream``

why a socket was closed.

faster with large input.

``tornado.options``

* `tornado.options` options with ``multiple=True`` that are set more than

once now overwrite rather than append. This makes it possible to override

* `tornado.options` ``--help`` output is now prettier.

* `tornado.options.options` now supports attribute assignment.

``RequestHandler`` subclasses will need to be renamed.

* `tornado.web.addslash` and ``removeslash`` decorators now send permanent

redirects (301) instead of temporary (302).

to flush or not.

overwrite the previous cookie instead of producing additional copies.

a status code in addition to the headers and chunk. This is a

backwards-incompatible change to an interface that was never technically

private, but was not included in the documentation and does not appear

to have been used outside Tornado itself.

are constructed from unicode strings and keyword arguments are extracted.

* The ``reverse_url`` function in the template namespace now comes from

method).

* The ``Etag`` header is now returned on 304 responses to an ``If-None-Match``

request, improving compatibility with some caches.

in the url.

* The ``extra_params`` argument to `tornado.escape.linkify` may now be

a callable, to allow parameters to be chosen separately for each link.

function is called repeatedly.

* `tornado.locale.get_supported_locales` no longer takes a meaningless

``cls`` argument.

used to prevent further propagation.

* `tornado.testing.AsyncTestCase.wait` now resets its timeout on each call.

* `tornado.wsgi.WSGIApplication` now parses arguments correctly on Python 3.

* Exception handling on Python 3 has been improved; previously some exceptions