What’s new in Tornado 2.1¶
Sep 20, 2011¶
Backwards-incompatible changes¶
- Support for secure cookies written by pre-1.0 releases of Tornado has been removed. The RequestHandler.get_secure_cookie method no longer takes an include_name parameter.
- The debug application setting now causes stack traces to be displayed in the browser on uncaught exceptions. Since this may leak sensitive information, debug mode is not recommended for public-facing servers.
Security fixes¶
- Diginotar has been removed from the default CA certificates file used by SimpleAsyncHTTPClient.
New modules¶
- tornado.gen: A generator-based interface to simplify writing asynchronous functions.
- tornado.netutil: Parts of tornado.httpserver have been extracted into a new module for use with non-HTTP protocols.
- tornado.platform.twisted: A bridge between the Tornado IOLoop and the Twisted Reactor, allowing code written for Twisted to be run on Tornado.
- tornado.process: Multi-process mode has been improved, and can now restart crashed child processes. A new entry point has been added at tornado.process.fork_processes, although tornado.httpserver.HTTPServer.start is still supported.
tornado.web¶
- tornado.web.RequestHandler.write_error replaces get_error_html as the preferred way to generate custom error pages (get_error_html is still supported, but deprecated)
- In tornado.web.Application, handlers may be specified by (fully-qualified) name instead of importing and passing the class object itself.
- It is now possible to use a custom subclass of StaticFileHandler with the static_handler_class application setting, and this subclass can override the behavior of the static_url method.
- StaticFileHandler subclasses can now override get_cache_time to customize cache control behavior.
- tornado.web.RequestHandler.get_secure_cookie now has a max_age_days parameter to allow applications to override the default one-month expiration.
- set_cookie now accepts a max_age keyword argument to set the max-age cookie attribute (note underscore vs dash)
- tornado.web.RequestHandler.set_default_headers may be overridden to set headers in a way that does not get reset during error handling.
- RequestHandler.add_header can now be used to set a header that can appear multiple times in the response.
- RequestHandler.flush can now take a callback for flow control.
- The application/json content type can now be gzipped.
- The cookie-signing functions are now accessible as static functions tornado.web.create_signed_value and tornado.web.decode_signed_value.
tornado.httpserver¶
- To facilitate some advanced multi-process scenarios, HTTPServer has a new method add_sockets, and socket-opening code is available separately as tornado.netutil.bind_sockets.
- The cookies property is now available on tornado.httpserver.HTTPRequest (it is also available in its old location as a property of RequestHandler)
- tornado.httpserver.HTTPServer.bind now takes a backlog argument with the same meaning as socket.listen.
- HTTPServer can now be run on a unix socket as well as TCP.
- Fixed exception at startup when socket.AI_ADDRCONFIG is not available, as on Windows XP
IOLoop and IOStream¶
- IOStream performance has been improved, especially for small synchronous requests.
- New methods tornado.iostream.IOStream.read_until_close and tornado.iostream.IOStream.read_until_regex.
- IOStream.read_bytes and IOStream.read_until_close now take a streaming_callback argument to return data as it is received rather than all at once.
- IOLoop.add_timeout now accepts datetime.timedelta objects in addition to absolute timestamps.
- PeriodicCallback now sticks to the specified period instead of creeping later due to accumulated errors.
- tornado.ioloop.IOLoop and tornado.httpclient.HTTPClient now have close() methods that should be used in applications that create and destroy many of these objects.
- IOLoop.install can now be used to use a custom subclass of IOLoop as the singleton without monkey-patching.
- IOStream should now always call the close callback instead of the connect callback on a connection error.
- The IOStream close callback will no longer be called while there are pending read callbacks that can be satisfied with buffered data.
tornado.simple_httpclient¶
- Now supports client SSL certificates with the client_key and client_cert parameters to tornado.httpclient.HTTPRequest
- Now takes a maximum buffer size, to allow reading files larger than 100MB
- Now works with HTTP 1.0 servers that don’t send a Content-Length header
- The allow_nonstandard_methods flag on HTTP client requests now permits methods other than POST and PUT to contain bodies.
- Fixed file descriptor leaks and multiple callback invocations in SimpleAsyncHTTPClient
- No longer consumes extra connection resources when following redirects.
- Now works with buggy web servers that separate headers with \n instead of \r\n\r\n.
- Now sets response.request_time correctly.
- Connect timeouts now work correctly.
Other modules¶
- tornado.auth.OpenIdMixin now uses the correct realm when the callback URI is on a different domain.
- tornado.autoreload has a new command-line interface which can be used to wrap any script. This replaces the --autoreload argument to tornado.testing.main and is more robust against syntax errors.
- tornado.autoreload.watch can be used to watch files other than the sources of imported modules.
- tornado.database.Connection has new variants of execute and executemany that return the number of rows affected instead of the last inserted row id.
- tornado.locale.load_translations now accepts any properly-formatted locale name, not just those in the predefined LOCALE_NAMES list.
- tornado.options.define now takes a group parameter to group options in --help output.
- Template loaders now take a namespace constructor argument to add entries to the template namespace.
- tornado.websocket now supports the latest (“hybi-10”) version of the protocol (the old version, “hixie-76” is still supported; the correct version is detected automatically).
- tornado.websocket now works on Python 3
Bug fixes¶
- Windows support has been improved. Windows is still not an officially supported platform, but the test suite now passes and tornado.autoreload works.
- Uploading files whose names contain special characters will now work.
- Cookie values containing special characters are now properly quoted and unquoted.
- Multi-line headers are now supported.
- Repeated Content-Length headers (which may be added by certain proxies) are now supported in HTTPServer.
- Unicode string literals now work in template expressions.
- The template {% module %} directive now works even if applications use a template variable named modules.
- Requests with “Expect: 100-continue” now work on python 3