... tics ¶ An interaction between Google Analytics and Django's cookie parsing could allow an attacker to set arbitrary cookies leading to a bypass of CSRF protection. The parser for request.COOKIES is simplified to better match the behavior of brows ... ers and to mitigate this attack. request.COOKIES may now contain cookies that are invalid according to RFC 6265 but are possible to set via document.cookie . 目次 Django 1 ... 1.8.16 リリースノート 次のトピックへ Django 1.8.14 リリースノート 関連キーワード protection bypass Google Analytics cookie cookies request リリースノート September fixes security issue site interaction between parsing allow attacker arbitrary leading pa ... ... e Analytics ¶ An interaction between Google Analytics and Django's cookie parsing could allow an attacker to set arbitrary cookies leading to a bypass of CSRF protection. The parser for request.COOKIES is simplified to better match the behavior of brows ... ers and to mitigate this attack. request.COOKIES may now contain cookies that are invalid according to RFC 6265 but are possible to set via document.cookie . 目次 Django 1 ... 1.9.11 リリースノート 次のトピックへ Django 1.9.9 リリースノート 関連キーワード protection bypass Google Analytics cookie cookies request リリースノート September セキュリティ 問題 修正 site interaction between parsing allow attacker arbitrary leading ... ... tics ¶ An interaction between Google Analytics and Django's cookie parsing could allow an attacker to set arbitrary cookies leading to a bypass of CSRF protection. The parser for request.COOKIES is simplified to better match the behavior of brows ... ers and to mitigate this attack. request.COOKIES may now contain cookies that are invalid according to RFC 6265 but are possible to set via document.cookie . 目次 Django 1 ... 1.8.16 リリースノート 次のトピックへ Django 1.8.14 リリースノート 関連キーワード Django protection bypass Google Analytics cookie set cookies request リリースノート September fixes security issue site interaction between parsing allow attacker 関連するペ ... ... e Analytics ¶ An interaction between Google Analytics and Django's cookie parsing could allow an attacker to set arbitrary cookies leading to a bypass of CSRF protection. The parser for request.COOKIES is simplified to better match the behavior of brows ... ers and to mitigate this attack. request.COOKIES may now contain cookies that are invalid according to RFC 6265 but are possible to set via document.cookie . 目次 Django 1 ... 1.9.11 リリースノート 次のトピックへ Django 1.9.9 リリースノート 関連キーワード Django protection bypass Google Analytics cookie set cookies request リリースノート September セキュリティ 問題 修正 site interaction between parsing allow attacker 関連する ... ... ncatenating the cookie name ( key ) and salt arguments. When distinct name and salt pairs produced the same concatenation, cookies could be accepted in a context different from the one where they were signed. Cookies are now signed with an unambiguous s ... alt derivation. For backwards compatibility, cookies signed by older Django versions are accepted until Django 2028. Projects affected by the above ambiguity should set SIGNED ... _COOKIE_LEGACY_SALT_FALLBACK to False to reject older cookies immediately. This issue has severity "low" according to the Django security policy . CVE-2026-7666: Potential unencrypted ... ... ncatenating the cookie name ( key ) and salt arguments. When distinct name and salt pairs produced the same concatenation, cookies could be accepted in a context different from the one where they were signed. Cookies are now signed with an unambiguous s ... alt derivation. For backwards compatibility, cookies signed by older Django versions are accepted until Django 2028. Projects affected by the above ambiguity should set SIGNED ... _COOKIE_LEGACY_SALT_FALLBACK to False to reject older cookies immediately. This issue has severity "low" according to the Django security policy . CVE-2026-7666: Potential unencrypted ... ... translations from Transifex are incorporated. CVE-2026-6873: Signed cookie salt namespace collision ¶ get_signed_cookie() derived the signing salt by concatenating the cookie name ( key ) and salt a ... rguments. When distinct name and salt pairs produced the same concatenation, cookies could be accepted in a context different from the one where they were signed. Cookies are now signed with an unambiguous s ... alt derivation. For backwards compatibility, cookies signed by older Django versions are accepted until Django 2028. Projects affected by the above ambiguity should set SIGNED ... ... translations from Transifex are incorporated. CVE-2026-6873: Signed cookie salt namespace collision ¶ get_signed_cookie() derived the signing salt by concatenating the cookie name ( key ) and salt a ... rguments. When distinct name and salt pairs produced the same concatenation, cookies could be accepted in a context different from the one where they were signed. Cookies are now signed with an unambiguous s ... alt derivation. For backwards compatibility, cookies signed by older Django versions are accepted until Django 2028. Projects affected by the above ambiguity should set SIGNED ... ... ly 3.20.1). django.contrib.sessions ¶ Added the SESSION_COOKIE_SAMESITE setting to set the SameSite cookie flag on session cookies. キャッシュ ¶ The local-memory cache backend now uses a least-recently-used (LRU) culling strategy rather than a pseudo-ra ... ッシュキーのタイムアウトを更新します。 CSRF ¶ Added the CSRF_COOKIE_SAMESITE setting to set the SameSite cookie flag on CSRF cookies. フォーム ¶ The widget for ImageField now renders with the HTML attribute accept="image/*" . 国際化 (internationalization) ... . For example, in a custom input_option.html template, change {% if wrap_label %} to {% if widget.wrap_label %} . SameSite cookies ¶ The cookies used for django.contrib.sessions , django.contrib.messages , and Django's CSRF protection now set the SameSi ... ... eeded, the number of test failures can be found at the end of the test runner's output. Cookie encoding ¶ To fix bugs with cookies in Internet Explorer, Safari, and possibly other browsers, our encoding of cookie values was changed so that the character ... nd \073 respectively. This could produce backwards incompatibilities, especially if you are storing comma or semi-colon in cookies and have JavaScript code that parses and manipulates cookie values client-side. One new feature ¶ Ordinarily, a point rele ... se backwards features branch runner feature csrf token template リリースノート contain incompatibilities failures encoding cookies cookie values characters comma semi クイック検索 Last update: 2026年10月09日 « previous | up | next » ... 2026年10月08日