    candidate versions (e.g. '1.10rc1' instead of '1.10c1').
  
  * The ``LOGOUT_URL`` setting is removed as Django hasn't made use of it
    since pre-1.0. If you use it in your project, you can add it to your
    project's settings. The default value was ``'/accounts/logout/'``.
  
  * Objects with a ``close()`` method such as files and generators passed to
    :class:`~django.http.HttpResponse` are now closed immediately instead of when
 
</s> remove     (including ``GZipMiddleware``) are used on a website, the site becomes
    exposed to a number of possible attacks. These approaches can be used to
    compromise, among other things, Django's CSRF protection. Before using
    ``GZipMiddleware`` on your site, you should consider very carefully whether
    you are subject to these attacks. If you're in *any* doubt about whether
    you're affected, you should avoid using ``GZipMiddleware``. For more
    details, see the `the BREACH paper (PDF)`_ and `breachattack.com`_.
 </s> add     (including ``GZipMiddleware``) are used on a website, the site may become
    exposed to a number of possible attacks. Before using ``GZipMiddleware`` on
    your site, you should consider very carefully whether you are subject to
    these attacks. If you're in *any* doubt about whether you're affected, you
    should avoid using ``GZipMiddleware``. For more details, see the `the BREACH
    paper (PDF)`_ and `breachattack.com`_. </s> remove    outgoing POST forms.  The value of this field is the value of the CSRF
   cookie.
 </s> add    outgoing POST forms. The value of this field is, again, the value of the
   secret, with a salt which is both added to it and used to scramble it. The
   salt is regenerated on every call to ``get_token()`` so that the form field
   value is changed in every such response. </s> remove :ref:`CSRF protection works <how-csrf-works>` by checking for a nonce in each
 </s> add :ref:`CSRF protection works <how-csrf-works>` by checking for a secret in each </s> remove    when using a session independent nonce, due to the fact that HTTP
 </s> add    when using a session independent secret, due to the fact that HTTP
* CSRF token values are now required to be strings of 64 alphanumerics; values
  of 32 alphanumerics, as set by older versions of Django by default, are
  automatically replaced by strings of 64 characters. Other values are
  considered invalid. This should only affect developers or users who replace
  these tokens.

    candidate versions (e.g. '1.10rc1' instead of '1.10c1').
  
* CSRF token values are now required to be strings of 64 alphanumerics; values
  of 32 alphanumerics, as set by older versions of Django by default, are
  automatically replaced by strings of 64 characters. Other values are
  considered invalid. This should only affect developers or users who replace
  these tokens.

  * The ``LOGOUT_URL`` setting is removed as Django hasn't made use of it
    since pre-1.0. If you use it in your project, you can add it to your
    project's settings. The default value was ``'/accounts/logout/'``.
  
  * Objects with a ``close()`` method such as files and generators passed to
    :class:`~django.http.HttpResponse` are now closed immediately instead of when
keep add keep keep keep keep keep keep
 Fixed #20869 -- made CSRF tokens change every request by salt-encrypting them

Note that the cookie is not changed every request, just the token retrieved
by the `get_token()` method (used also by the `{% csrf_token %}` tag).

While at it, made token validation strict: Where, before, any length was
accepted and non-ASCII chars were ignored, we now treat anything other than
`[A-Za-z0-9]{64}` as invalid (except for 32-char tokens, which, for
backwards-compatibility, are accepted and replaced by 64-char ones).

Thanks Trac user patrys for reporting, github user adambrenecki
for initial patch, Tim Graham for help, and Curtis Maloney,
Collin Anderson, Florian Apolloner, Markus Holtermann & Jon Dufresne
for reviews. 
docs/releases/1.10.txt