diff options
| author | Jacob Walls <jacobtylerwalls@gmail.com> | 2026-03-31 15:43:18 -0400 |
|---|---|---|
| committer | Jacob Walls <jacobtylerwalls@gmail.com> | 2026-04-02 09:19:07 -0400 |
| commit | 2ee757ee502d5663f932dc5c35175c39af4640ce (patch) | |
| tree | d540419df5cd17f7ccb22b84213cc64682758970 /docs/internals | |
| parent | a32c7075cf634aee1f4f3deecd27f194097ec0c2 (diff) | |
Fixed #36862 -- Doc'd the need for a proxy when deploying RemoteUserMiddleware under ASGI.
We have a flood of nuisance security reports describing ASGI deployments
using RemoteUserMiddleware without a fronting proxy, which is not
realistic.
Diffstat (limited to 'docs/internals')
| -rw-r--r-- | docs/internals/security.txt | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/docs/internals/security.txt b/docs/internals/security.txt index 5214bf0704..2f73a906bc 100644 --- a/docs/internals/security.txt +++ b/docs/internals/security.txt @@ -131,6 +131,12 @@ not been sanitized:: q = MyModel.objects.extra(select={"id": query}) return HttpResponse(q.values()) +Some HTTP headers must also be sanitized by a web server or fronting proxy +before they can be used, such as ``Remote-User`` and ``X-Forwarded-*``. For +instance, under ASGI, it is a deployment misconfiguration (rather than any flaw +in Django) for Django to be the direct HTTP endpoint when +:class:`~django.contrib.auth.middleware.RemoteUserMiddleware` is used. + Request headers and URLs must be under 8K bytes ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ |