diff options
| author | Gordon Pendleton <wgordonw1@gmail.com> | 2019-11-23 21:17:31 -0500 |
|---|---|---|
| committer | Mariusz Felisiak <felisiak.mariusz@gmail.com> | 2019-12-05 09:44:45 +0100 |
| commit | adb96617897690b3a01e39e8297ae7d67825d2bc (patch) | |
| tree | 06f5846cb8cd688ab4ecab95e2b7d2884a0f23c4 /docs | |
| parent | 3930ec1bf275d17f1c36cd38b38114177b1d1565 (diff) | |
Fixed #31010 -- Allowed subdomains of localhost in the Host header by default when DEBUG=True.
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/ref/settings.txt | 7 | ||||
| -rw-r--r-- | docs/releases/3.1.txt | 3 |
2 files changed, 8 insertions, 2 deletions
diff --git a/docs/ref/settings.txt b/docs/ref/settings.txt index 6c8ea9b762..3c360cf284 100644 --- a/docs/ref/settings.txt +++ b/docs/ref/settings.txt @@ -90,7 +90,7 @@ list, the :meth:`django.http.HttpRequest.get_host()` method will raise :exc:`~django.core.exceptions.SuspiciousOperation`. When :setting:`DEBUG` is ``True`` and ``ALLOWED_HOSTS`` is empty, the host -is validated against ``['localhost', '127.0.0.1', '[::1]']``. +is validated against ``['.localhost', '127.0.0.1', '[::1]']``. ``ALLOWED_HOSTS`` is also :ref:`checked when running tests <topics-testing-advanced-multiple-hosts>`. @@ -99,6 +99,11 @@ This validation only applies via :meth:`~django.http.HttpRequest.get_host()`; if your code accesses the ``Host`` header directly from ``request.META`` you are bypassing this security protection. +.. versionchanged:: 3.1 + + If ``ALLOWED_HOSTS`` is empty and ``DEBUG=True``, subdomains of localhost + were allowed. + .. setting:: APPEND_SLASH ``APPEND_SLASH`` diff --git a/docs/releases/3.1.txt b/docs/releases/3.1.txt index 4c8cc56797..631978d0ac 100644 --- a/docs/releases/3.1.txt +++ b/docs/releases/3.1.txt @@ -222,7 +222,8 @@ Pagination Requests and Responses ~~~~~~~~~~~~~~~~~~~~~~ -* ... +* If :setting:`ALLOWED_HOSTS` is empty and ``DEBUG=True``, subdomains of + localhost are now allowed in the ``Host`` header, e.g. ``static.localhost``. Serialization ~~~~~~~~~~~~~ |