{"title":"Django 1.7.10 release notes","version":"dev","locale":"en","docname":"releases/1.7.10","url":"/en/dev/releases/1.7.10/","canonical":"https://djangodocs.dev/en/dev/releases/1.7.10/","summary":"Django 1.7.10 fixes a security issue in 1.7.9. Previously, a session could be created when anonymously accessing the django.contrib.auth.views.logout() view…","html":"<h1>Django 1.7.10 release notes<a class=\"heading-anchor\" href=\"#django-1-7-10-release-notes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h1>\n<p><em>August 18, 2015</em></p>\n<p>Django 1.7.10 fixes a security issue in 1.7.9.</p>\n<section id=\"denial-of-service-possibility-in-logout-view-by-filling-session-store\">\n<h2>Denial-of-service possibility in <code class=\"docutils literal notranslate\">logout()</code> view by filling session store<a class=\"heading-anchor\" href=\"#denial-of-service-possibility-in-logout-view-by-filling-session-store\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>Previously, a session could be created when anonymously accessing the\n<code class=\"docutils literal notranslate\">django.contrib.auth.views.logout()</code> view (provided it wasn’t decorated\nwith <a class=\"reference internal\" href=\"/en/dev/topics/auth/default/#django.contrib.auth.decorators.login_required\" title=\"django.contrib.auth.decorators.login_required\"><code class=\"xref py py-func docutils literal notranslate\">login_required()</code></a> as done in the\nadmin). This could allow an attacker to easily create many new session records\nby sending repeated requests, potentially filling up the session store or\ncausing other users’ session records to be evicted.</p>\n<p>The <a class=\"reference internal\" href=\"/en/dev/ref/middleware/#django.contrib.sessions.middleware.SessionMiddleware\" title=\"django.contrib.sessions.middleware.SessionMiddleware\"><code class=\"xref py py-class docutils literal notranslate\">SessionMiddleware</code></a> has been\nmodified to no longer create empty session records, including when\n<a class=\"reference internal\" href=\"/en/dev/ref/settings/#std-setting-SESSION_SAVE_EVERY_REQUEST\"><code class=\"xref std std-setting docutils literal notranslate\">SESSION_SAVE_EVERY_REQUEST</code></a> is active.</p>\n<p>Additionally, the <code class=\"docutils literal notranslate\">contrib.sessions.backends.base.SessionBase.flush()</code> and\n<code class=\"docutils literal notranslate\">cache_db.SessionStore.flush()</code> methods have been modified to avoid creating\na new empty session. Maintainers of third-party session backends should check\nif the same vulnerability is present in their backend and correct it if so.</p>\n</section>","rootId":"django-1-7-10-release-notes","toc":[{"title":"Denial-of-service possibility in logout() view by filling session store","anchor":"denial-of-service-possibility-in-logout-view-by-filling-session-store","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/1.7.11","title":"Django 1.7.11 release notes","url":"/en/dev/releases/1.7.11/"},"next":{"docname":"releases/1.7.9","title":"Django 1.7.9 release notes","url":"/en/dev/releases/1.7.9/"},"formats":{"html":"/en/dev/releases/1.7.10/","markdown":"/en/dev/releases/1.7.10.md","json":"/en/dev/releases/1.7.10.json"},"source":"https://github.com/django/django/blob/main/docs/releases/1.7.10.txt","official":"https://docs.djangoproject.com/en/dev/releases/1.7.10/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1","2.0","1.11","1.10","1.9","1.8"],"inLocales":["en"]}