{"title":"Django 1.9.10 release notes","version":"dev","locale":"en","docname":"releases/1.9.10","url":"/en/dev/releases/1.9.10/","canonical":"https://djangodocs.dev/en/dev/releases/1.9.10/","summary":"Django 1.9.10 fixes a security issue in 1.9.9. An interaction between Google Analytics and Django’s cookie parsing could allow an attacker to set arbitrary…","html":"<h1>Django 1.9.10 release notes<a class=\"heading-anchor\" href=\"#django-1-9-10-release-notes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h1>\n<p><em>September 26, 2016</em></p>\n<p>Django 1.9.10 fixes a security issue in 1.9.9.</p>\n<section id=\"csrf-protection-bypass-on-a-site-with-google-analytics\">\n<h2>CSRF protection bypass on a site with Google Analytics<a class=\"heading-anchor\" href=\"#csrf-protection-bypass-on-a-site-with-google-analytics\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>An interaction between Google Analytics and Django’s cookie parsing could allow\nan attacker to set arbitrary cookies leading to a bypass of CSRF protection.</p>\n<p>The parser for <code class=\"docutils literal notranslate\">request.COOKIES</code> is simplified to better match the behavior\nof browsers and to mitigate this attack. <code class=\"docutils literal notranslate\">request.COOKIES</code> may now contain\ncookies that are invalid according to <span class=\"target\" id=\"index-0\"></span><a class=\"rfc reference external\" href=\"https://datatracker.ietf.org/doc/html/rfc6265.html\"><strong>RFC 6265</strong></a> but are possible to set via\n<code class=\"docutils literal notranslate\">document.cookie</code>.</p>\n</section>","rootId":"django-1-9-10-release-notes","toc":[{"title":"CSRF protection bypass on a site with Google Analytics","anchor":"csrf-protection-bypass-on-a-site-with-google-analytics","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/1.9.11","title":"Django 1.9.11 release notes","url":"/en/dev/releases/1.9.11/"},"next":{"docname":"releases/1.9.9","title":"Django 1.9.9 release notes","url":"/en/dev/releases/1.9.9/"},"formats":{"html":"/en/dev/releases/1.9.10/","markdown":"/en/dev/releases/1.9.10.md","json":"/en/dev/releases/1.9.10.json"},"source":"https://github.com/django/django/blob/main/docs/releases/1.9.10.txt","official":"https://docs.djangoproject.com/en/dev/releases/1.9.10/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1","2.0","1.11","1.10","1.9"],"inLocales":["en"]}