facebook/tornado — pull request #557 by raullenchai (2012-07-03 00:35:53+00:00)
Title: return None when a secure-cookie is forged

A very simple bug fixing!

It seems one forgot to return None when a secure-cookie is forged -- where the timestamp starts with a "0" -- in the function "decode_signed_value", a mechanism designed to defeat the following forgery:

"TWFu0000|1341271759|02233ed3df447a08059ccb6e4fd0d19797b3e435" forges as
"TWFu|00001341271759|02233ed3df447a08059ccb6e4fd0d19797b3e435"

Note that, the fixing does not change the logic of this function but makes the "returns" more consistency.