---
title: "Django 1.9.10 release notes"
version: 4.1
locale: pl
source: https://docs.djangoproject.com/pl/4.1/releases/1.9.10/
canonical: https://djangodocs.dev/pl/4.1/releases/1.9.10/
---
# Django 1.9.10 release notes

*26 września 2016*

Django 1.9.10 fixes a security issue in 1.9.9.

## CSRF protection bypass on a site with Google Analytics

An interaction between Google Analytics and Django’s cookie parsing could allow
an attacker to set arbitrary cookies leading to a bypass of CSRF protection.

The parser for `request.COOKIES` is simplified to better match the behavior
of browsers and to mitigate this attack. `request.COOKIES` may now contain
cookies that are invalid according to [**RFC 6265**](https://datatracker.ietf.org/doc/html/rfc6265.html) but are possible to set via
`document.cookie`.