# Documentazione Django 6.0.7

# Note di rilascio di Django 1.9.10

26 Settembre 2016

Django 1.9.10 risolve un problema di sicurezza in 1.9.9.

## CSRF protection bypass on a site with Google Analytics

An interaction between Google Analytics and Django’s cookie parsing could allow an attacker to set arbitrary cookies leading to a bypass of CSRF protection.

The parser for `request.COOKIES` is simplified to better match the behavior of browsers and to mitigate this attack. `request.COOKIES` may now contain cookies that are invalid according to RFC 6265 but are possible to set via `document.cookie`.