From c05930c858bdfe59dec5fa257dc05b614fa7320b Mon Sep 17 00:00:00 2001 From: Paul McMillan Date: Thu, 16 Feb 2012 02:08:11 +0000 Subject: [PATCH] Added an explicit warning about cookie session store to release notes. git-svn-id: http://code.djangoproject.com/svn/django/trunk@17529 bcc190cf-cafb-0310-a4f2-bffc1f526a37 --- docs/releases/1.4-beta-1.txt | 7 +++++++ docs/releases/1.4.txt | 8 ++++++++ 2 files changed, 15 insertions(+) diff --git a/docs/releases/1.4-beta-1.txt b/docs/releases/1.4-beta-1.txt index a3b8ef07d5..37cc60e258 100644 --- a/docs/releases/1.4-beta-1.txt +++ b/docs/releases/1.4-beta-1.txt @@ -197,6 +197,13 @@ Django 1.4 introduces a new cookie-based backend for the session framework which uses the tools for :doc:`cryptographic signing ` to store the session data in the client's browser. +.. warning:: + + Session data is signed and validated by the server, but is not + encrypted. This means that a user can view any data stored in the + session, but cannot change it. Please read the documentation for + further clarification before using this backend. + See the :ref:`cookie-based session backend ` docs for more information. diff --git a/docs/releases/1.4.txt b/docs/releases/1.4.txt index 1932b94fca..c55d6654c6 100644 --- a/docs/releases/1.4.txt +++ b/docs/releases/1.4.txt @@ -171,6 +171,14 @@ Django 1.4 introduces a cookie-based session backend that uses the tools for :doc:`cryptographic signing ` to store the session data in the client's browser. ++.. warning:: ++ ++ Session data is signed and validated by the server, but is not ++ encrypted. This means that a user can view any data stored in the ++ session, but cannot change it. Please read the documentation for ++ further clarification before using this backend. ++ + See the :ref:`cookie-based session backend ` docs for more information.