Announcing Tornado 6.3

[Ben Darnell]

I am pleased to announce the release of Tornado 6.3.0. This release includes a number of significant benefits including the reversal of several deprecation changes made in Tornado 6.2.

Highlights

    The new Application setting xsrf_cookie_name can now be used to take advantage of the __Host cookie prefix for improved security. To use it, add {"xsrf_cookie_name": "__Host-xsrf", "xsrf_cookie_kwargs": {"secure": True}} to your Application settings. Note that this feature currently only works when HTTPS is used.

    WSGIContainer now supports running the application in a ThreadPoolExecutor so the event loop is no longer blocked.

    AsyncTestCase and AsyncHTTPTestCase, which were deprecated in Tornado 6.2, are no longer deprecated.

    WebSockets are now much faster at receiving large messages split into many fragments.

Full release notes are available at https://www.tornadoweb.org/en/stable/releases/v6.3.0.html. Downloads are available via https://pypi.org/project/tornado/ and

    pip install tornado==6.3.0

-Ben