Commit a74240a

What's new in Tornado 6.5.6

May 27, 2026

Security fixes

- ``SimpleAsyncHTTPClient`` now strips the ``Authorization`` and ``Cookie`` headers from the request

when following a redirect to a different origin. This matches the default behavior of

``CurlAsyncHTTPClient``. Applications that need different behavior here can set

``follow_redirects=False`` and handle redirects manually. Thanks to [Yannick

Wang](https://github.com/noobone123) for being first to report this issue, as well as additional

reporters [Kai Aizen](https://github.com/SnailSploit), [HunSec](https://github.com/0xHunSec), and

[Thai Son Dinh](https://github.com/sondt99).

- ``SimpleAsyncHTTPClient`` now enforces ``max_body_size`` on the decompressed size of the response,

rather than the compressed size. This prevents a denial-of-service attack via a very large

compressed response. Thanks to [Yuichiro Kedashiro](https://github.com/yuui25) for reporting this

issue.

- Fixed a bug in the C extension that could have read up to three bytes past the end of an input

array. Thanks to [Thai Son Dinh](https://github.com/sondt99) for reporting this issue.

- ``OpenIDMixin`` has improved parsing for the ``check_authentication`` response. Thanks to

[Yannick Wang](https://github.com/noobone123) for reporting this issue.

Bug fixes

- ``CurlAsyncHTTPClient`` has been updated to use non-deprecated APIs, avoiding deprecation

warnings with recent versions of ``pycurl``.

version = "6.5.6"

version_info = (6, 5, 6, 0)