{"action":"created","comment":{"url":"https://api.github.com/repos/django/django/pulls/comments/60089404","id":60089404,"diff_hunk":"@@ -212,6 +212,16 @@ CSRF\n   accepts an optional ``template_name`` parameter, defaulting to\n   ``'403_csrf.html'``, to control the template used to render the page.\n \n+* To protect against `BREACH`_ attacks, the CSRF protection scheme is changed\n+  so that the form token value is changed on every request (while keeping an\n+  invariant nonce which can be used to validate them).\n+\n+  To make this easier, the CSRF cookie values are forced to be strings of","path":"docs/releases/1.10.txt","position":8,"original_position":8,"commit_id":"e79f04b35b9833330f3bd7a4dee4dcd56dd55340","original_commit_id":"e79f04b35b9833330f3bd7a4dee4dcd56dd55340","user":{"login":"timgraham","id":411869,"avatar_url":"https://avatars.githubusercontent.com/u/411869?v=3","gravatar_id":"","url":"https://api.github.com/users/timgraham","html_url":"https://github.com/timgraham","followers_url":"https://api.github.com/users/timgraham/followers","following_url":"https://api.github.com/users/timgraham/following{/other_user}","gists_url":"https://api.github.com/users/timgraham/gists{/gist_id}","starred_url":"https://api.github.com/users/timgraham/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/timgraham/subscriptions","organizations_url":"https://api.github.com/users/timgraham/orgs","repos_url":"https://api.github.com/users/timgraham/repos","events_url":"https://api.github.com/users/timgraham/events{/privacy}","received_events_url":"https://api.github.com/users/timgraham/received_events","type":"User","site_admin":false},"body":"Probably don't need this bit here.","created_at":"2016-04-18T16:27:12Z","updated_at":"2016-04-18T16:27:12Z","html_url":"https://github.com/django/django/pull/5605#discussion_r60089404","pull_request_url":"https://api.github.com/repos/django/django/pulls/5605","_links":{"self":{"href":"https://api.github.com/repos/django/django/pulls/comments/60089404"},"html":{"href":"https://github.com/django/django/pull/5605#discussion_r60089404"},"pull_request":{"href":"https://api.github.com/repos/django/django/pulls/5605"}}},"pull_request":{"url":"https://api.github.com/repos/django/django/pulls/5605","id":50039619,"html_url":"https://github.com/django/django/pull/5605","diff_url":"https://github.com/django/django/pull/5605.diff","patch_url":"https://github.com/django/django/pull/5605.patch","issue_url":"https://api.github.com/repos/django/django/issues/5605","number":5605,"state":"open","locked":false,"title":"Fixed #20869: made CSRF tokens change every request","user":{"login":"shaib","id":129187,"avatar_url":"https://avatars.githubusercontent.com/u/129187?v=3","gravatar_id":"","url":"https://api.github.com/users/shaib","html_url":"https://github.com/shaib","followers_url":"https://api.github.com/users/shaib/followers","following_url":"https://api.github.com/users/shaib/following{/other_user}","gists_url":"https://api.github.com/users/shaib/gists{/gist_id}","starred_url":"https://api.github.com/users/shaib/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shaib/subscriptions","organizations_url":"https://api.github.com/users/shaib/orgs","repos_url":"https://api.github.com/users/shaib/repos","events_url":"https://api.github.com/users/shaib/events{/privacy}","received_events_url":"https://api.github.com/users/shaib/received_events","type":"User","site_admin":false},"body":"@PaulMcMillan would appreciate your review","created_at":"2015-11-07T16:41:57Z","updated_at":"2016-04-18T16:27:12Z","closed_at":null,"merged_at":null,"merge_commit_sha":"8c4cefe3dc3920ab82906a1c4e5a025414cc3448","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/django/django/pulls/5605/commits","review_comments_url":"https://api.github.com/repos/django/django/pulls/5605/comments","review_comment_url":"https://api.github.com/repos/django/django/pulls/comments{/number}","comments_url":"https://api.github.com/repos/django/django/issues/5605/comments","statuses_url":"https://api.github.com/repos/django/django/statuses/e79f04b35b9833330f3bd7a4dee4dcd56dd55340","head":{"label":"shaib:ticket_20869","ref":"ticket_20869","sha":"e79f04b35b9833330f3bd7a4dee4dcd56dd55340","user":{"login":"shaib","id":129187,"avatar_url":"https://avatars.githubusercontent.com/u/129187?v=3","gravatar_id":"","url":"https://api.github.com/users/shaib","html_url":"https://github.com/shaib","followers_url":"https://api.github.com/users/shaib/followers","following_url":"https://api.github.com/users/shaib/following{/other_user}","gists_url":"https://api.github.com/users/shaib/gists{/gist_id}","starred_url":"https://api.github.com/users/shaib/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shaib/subscriptions","organizations_url":"https://api.github.com/users/shaib/orgs","repos_url":"https://api.github.com/users/shaib/repos","events_url":"https://api.github.com/users/shaib/events{/privacy}","received_events_url":"https://api.github.com/users/shaib/received_events","type":"User","site_admin":false},"repo":{"id":5945975,"name":"django","full_name":"shaib/django","owner":{"login":"shaib","id":129187,"avatar_url":"https://avatars.githubusercontent.com/u/129187?v=3","gravatar_id":"","url":"https://api.github.com/users/shaib","html_url":"https://github.com/shaib","followers_url":"https://api.github.com/users/shaib/followers","following_url":"https://api.github.com/users/shaib/following{/other_user}","gists_url":"https://api.github.com/users/shaib/gists{/gist_id}","starred_url":"https://api.github.com/users/shaib/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shaib/subscriptions","organizations_url":"https://api.github.com/users/shaib/orgs","repos_url":"https://api.github.com/users/shaib/repos","events_url":"https://api.github.com/users/shaib/events{/privacy}","received_events_url":"https://api.github.com/users/shaib/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/shaib/django","description":"The Web framework for perfectionists with deadlines.","fork":true,"url":"https://api.github.com/repos/shaib/django","forks_url":"https://api.github.com/repos/shaib/django/forks","keys_url":"https://api.github.com/repos/shaib/django/keys{/key_id}","collaborators_url":"https://api.github.com/repos/shaib/django/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/shaib/django/teams","hooks_url":"https://api.github.com/repos/shaib/django/hooks","issue_events_url":"https://api.github.com/repos/shaib/django/issues/events{/number}","events_url":"https://api.github.com/repos/shaib/django/events","assignees_url":"https://api.github.com/repos/shaib/django/assignees{/user}","branches_url":"https://api.github.com/repos/shaib/django/branches{/branch}","tags_url":"https://api.github.com/repos/shaib/django/tags","blobs_url":"https://api.github.com/repos/shaib/django/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/shaib/django/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/shaib/django/git/refs{/sha}","trees_url":"https://api.github.com/repos/shaib/django/git/trees{/sha}","statuses_url":"https://api.github.com/repos/shaib/django/statuses/{sha}","languages_url":"https://api.github.com/repos/shaib/django/languages","stargazers_url":"https://api.github.com/repos/shaib/django/stargazers","contributors_url":"https://api.github.com/repos/shaib/django/contributors","subscribers_url":"https://api.github.com/repos/shaib/django/subscribers","subscription_url":"https://api.github.com/repos/shaib/django/subscription","commits_url":"https://api.github.com/repos/shaib/django/commits{/sha}","git_commits_url":"https://api.github.com/repos/shaib/django/git/commits{/sha}","comments_url":"https://api.github.com/repos/shaib/django/comments{/number}","issue_comment_url":"https://api.github.com/repos/shaib/django/issues/comments{/number}","contents_url":"https://api.github.com/repos/shaib/django/contents/{+path}","compare_url":"https://api.github.com/repos/shaib/django/compare/{base}...{head}","merges_url":"https://api.github.com/repos/shaib/django/merges","archive_url":"https://api.github.com/repos/shaib/django/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/shaib/django/downloads","issues_url":"https://api.github.com/repos/shaib/django/issues{/number}","pulls_url":"https://api.github.com/repos/shaib/django/pulls{/number}","milestones_url":"https://api.github.com/repos/shaib/django/milestones{/number}","notifications_url":"https://api.github.com/repos/shaib/django/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/shaib/django/labels{/name}","releases_url":"https://api.github.com/repos/shaib/django/releases{/id}","deployments_url":"https://api.github.com/repos/shaib/django/deployments","created_at":"2012-09-25T06:37:26Z","updated_at":"2014-08-22T01:19:56Z","pushed_at":"2016-04-10T22:06:47Z","git_url":"git://github.com/shaib/django.git","ssh_url":"git@github.com:shaib/django.git","clone_url":"https://github.com/shaib/django.git","svn_url":"https://github.com/shaib/django","homepage":"http://www.djangoproject.com/","size":131188,"stargazers_count":0,"watchers_count":0,"language":"Python","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"django:master","ref":"master","sha":"b1b05a017ac87ef0ede3236a89a0627bf11d053a","user":{"login":"django","id":27804,"avatar_url":"https://avatars.githubusercontent.com/u/27804?v=3","gravatar_id":"","url":"https://api.github.com/users/django","html_url":"https://github.com/django","followers_url":"https://api.github.com/users/django/followers","following_url":"https://api.github.com/users/django/following{/other_user}","gists_url":"https://api.github.com/users/django/gists{/gist_id}","starred_url":"https://api.github.com/users/django/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/django/subscriptions","organizations_url":"https://api.github.com/users/django/orgs","repos_url":"https://api.github.com/users/django/repos","events_url":"https://api.github.com/users/django/events{/privacy}","received_events_url":"https://api.github.com/users/django/received_events","type":"Organization","site_admin":false},"repo":{"id":4164482,"name":"django","full_name":"django/django","owner":{"login":"django","id":27804,"avatar_url":"https://avatars.githubusercontent.com/u/27804?v=3","gravatar_id":"","url":"https://api.github.com/users/django","html_url":"https://github.com/django","followers_url":"https://api.github.com/users/django/followers","following_url":"https://api.github.com/users/django/following{/other_user}","gists_url":"https://api.github.com/users/django/gists{/gist_id}","starred_url":"https://api.github.com/users/django/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/django/subscriptions","organizations_url":"https://api.github.com/users/django/orgs","repos_url":"https://api.github.com/users/django/repos","events_url":"https://api.github.com/users/django/events{/privacy}","received_events_url":"https://api.github.com/users/django/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/django/django","description":"The Web framework for perfectionists with deadlines.","fork":false,"url":"https://api.github.com/repos/django/django","forks_url":"https://api.github.com/repos/django/django/forks","keys_url":"https://api.github.com/repos/django/django/keys{/key_id}","collaborators_url":"https://api.github.com/repos/django/django/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/django/django/teams","hooks_url":"https://api.github.com/repos/django/django/hooks","issue_events_url":"https://api.github.com/repos/django/django/issues/events{/number}","events_url":"https://api.github.com/repos/django/django/events","assignees_url":"https://api.github.com/repos/django/django/assignees{/user}","branches_url":"https://api.github.com/repos/django/django/branches{/branch}","tags_url":"https://api.github.com/repos/django/django/tags","blobs_url":"https://api.github.com/repos/django/django/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/django/django/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/django/django/git/refs{/sha}","trees_url":"https://api.github.com/repos/django/django/git/trees{/sha}","statuses_url":"https://api.github.com/repos/django/django/statuses/{sha}","languages_url":"https://api.github.com/repos/django/django/languages","stargazers_url":"https://api.github.com/repos/django/django/stargazers","contributors_url":"https://api.github.com/repos/django/django/contributors","subscribers_url":"https://api.github.com/repos/django/django/subscribers","subscription_url":"https://api.github.com/repos/django/django/subscription","commits_url":"https://api.github.com/repos/django/django/commits{/sha}","git_commits_url":"https://api.github.com/repos/django/django/git/commits{/sha}","comments_url":"https://api.github.com/repos/django/django/comments{/number}","issue_comment_url":"https://api.github.com/repos/django/django/issues/comments{/number}","contents_url":"https://api.github.com/repos/django/django/contents/{+path}","compare_url":"https://api.github.com/repos/django/django/compare/{base}...{head}","merges_url":"https://api.github.com/repos/django/django/merges","archive_url":"https://api.github.com/repos/django/django/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/django/django/downloads","issues_url":"https://api.github.com/repos/django/django/issues{/number}","pulls_url":"https://api.github.com/repos/django/django/pulls{/number}","milestones_url":"https://api.github.com/repos/django/django/milestones{/number}","notifications_url":"https://api.github.com/repos/django/django/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/django/django/labels{/name}","releases_url":"https://api.github.com/repos/django/django/releases{/id}","deployments_url":"https://api.github.com/repos/django/django/deployments","created_at":"2012-04-28T02:47:18Z","updated_at":"2016-04-18T13:48:32Z","pushed_at":"2016-04-18T16:16:44Z","git_url":"git://github.com/django/django.git","ssh_url":"git@github.com:django/django.git","clone_url":"https://github.com/django/django.git","svn_url":"https://github.com/django/django","homepage":"https://www.djangoproject.com/","size":185101,"stargazers_count":19006,"watchers_count":19006,"language":"Python","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":7686,"mirror_url":null,"open_issues_count":87,"forks":7686,"open_issues":87,"watchers":19006,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/django/django/pulls/5605"},"html":{"href":"https://github.com/django/django/pull/5605"},"issue":{"href":"https://api.github.com/repos/django/django/issues/5605"},"comments":{"href":"https://api.github.com/repos/django/django/issues/5605/comments"},"review_comments":{"href":"https://api.github.com/repos/django/django/pulls/5605/comments"},"review_comment":{"href":"https://api.github.com/repos/django/django/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/django/django/pulls/5605/commits"},"statuses":{"href":"https://api.github.com/repos/django/django/statuses/e79f04b35b9833330f3bd7a4dee4dcd56dd55340"}}}}