diff options
| author | Gordon Pendleton <wgordonw1@gmail.com> | 2019-11-23 21:17:31 -0500 |
|---|---|---|
| committer | Mariusz Felisiak <felisiak.mariusz@gmail.com> | 2019-12-05 09:44:45 +0100 |
| commit | adb96617897690b3a01e39e8297ae7d67825d2bc (patch) | |
| tree | 06f5846cb8cd688ab4ecab95e2b7d2884a0f23c4 /docs/ref | |
| parent | 3930ec1bf275d17f1c36cd38b38114177b1d1565 (diff) | |
Fixed #31010 -- Allowed subdomains of localhost in the Host header by default when DEBUG=True.
Diffstat (limited to 'docs/ref')
| -rw-r--r-- | docs/ref/settings.txt | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/docs/ref/settings.txt b/docs/ref/settings.txt index 6c8ea9b762..3c360cf284 100644 --- a/docs/ref/settings.txt +++ b/docs/ref/settings.txt @@ -90,7 +90,7 @@ list, the :meth:`django.http.HttpRequest.get_host()` method will raise :exc:`~django.core.exceptions.SuspiciousOperation`. When :setting:`DEBUG` is ``True`` and ``ALLOWED_HOSTS`` is empty, the host -is validated against ``['localhost', '127.0.0.1', '[::1]']``. +is validated against ``['.localhost', '127.0.0.1', '[::1]']``. ``ALLOWED_HOSTS`` is also :ref:`checked when running tests <topics-testing-advanced-multiple-hosts>`. @@ -99,6 +99,11 @@ This validation only applies via :meth:`~django.http.HttpRequest.get_host()`; if your code accesses the ``Host`` header directly from ``request.META`` you are bypassing this security protection. +.. versionchanged:: 3.1 + + If ``ALLOWED_HOSTS`` is empty and ``DEBUG=True``, subdomains of localhost + were allowed. + .. setting:: APPEND_SLASH ``APPEND_SLASH`` |