Merge pull request tornadoweb#557 from raullenchai/master

Fix handling of a limited form of secure_cookie tampering
Frostman · Jul 4, 2012 · 00688f9 · 00688f9
2 parents 61007f8 + 1ca245f
commit 00688f9
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/tornado/web.py b/tornado/web.py
@@ -2046,6 +2046,7 @@ def decode_signed_value(secret, name, value, max_age_days=31):
         return None
     if parts[1].startswith(b("0")):
         logging.warning("Tampered cookie %r", value)
+        return None
     try:
         return base64.b64decode(parts[0])
     except Exception: