WebSocket connections from other origin sites are now rejected by default. Browsers do not use the same-origin policy for WebSocket connections as they do for most other browser-initiated communications. This can be surprising and a security risk, so we disallow these connections on the server side by default. To accept cross-origin websocket connections, override the new method WebSocketHandler.check_origin .

WebSocketHandler.close and WebSocketClientConnection.close now support code and reason arguments to send a status code and message to the other side of the connection when closing. Both classes also have close_code and close_reason attributes to receive these values when the other side closes.

The C speedup module now builds correctly with MSVC, and can support messages larger than 2GB on 64-bit systems.

The fallback mechanism for detecting a missing C compiler now works correctly on Mac OS X.

Arguments to WebSocketHandler.open are now decoded in the same way as arguments to RequestHandler.get and similar methods.