diff options
| author | Russell Keith-Magee <russell@keith-magee.com> | 2011-09-10 01:28:31 +0000 |
|---|---|---|
| committer | Russell Keith-Magee <russell@keith-magee.com> | 2011-09-10 01:28:31 +0000 |
| commit | c613af4d6485586c79d692b70a9acac429f3ca9d (patch) | |
| tree | ba85a48d964f703d41c304b180808866aa5ebc7f /docs | |
| parent | 285b464fb8cb972af6bbdd7cf62b46e75c128a64 (diff) | |
[1.2.X] Added protection against spoofing of X_FORWARDED_HOST headers. A security announcement will be made shortly.
Backport of r16758 from trunk.
git-svn-id: http://code.djangoproject.com/svn/django/branches/releases/1.2.X@16764 bcc190cf-cafb-0310-a4f2-bffc1f526a37
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/ref/request-response.txt | 9 | ||||
| -rw-r--r-- | docs/ref/settings.txt | 13 |
2 files changed, 18 insertions, 4 deletions
diff --git a/docs/ref/request-response.txt b/docs/ref/request-response.txt index fd01cf9138..7837b6bede 100644 --- a/docs/ref/request-response.txt +++ b/docs/ref/request-response.txt @@ -185,10 +185,11 @@ Methods .. method:: HttpRequest.get_host() - Returns the originating host of the request using information from the - ``HTTP_X_FORWARDED_HOST`` and ``HTTP_HOST`` headers (in that order). If - they don't provide a value, the method uses a combination of - ``SERVER_NAME`` and ``SERVER_PORT`` as detailed in `PEP 333`_. + Returns the originating host of the request using information from + the ``HTTP_X_FORWARDED_HOST`` (if enabled in the settings) and ``HTTP_HOST`` + headers (in that order). If they don't provide a value, the method + uses a combination of ``SERVER_NAME`` and ``SERVER_PORT`` as + detailed in :pep:`3333`. .. _PEP 333: http://www.python.org/dev/peps/pep-0333/ diff --git a/docs/ref/settings.txt b/docs/ref/settings.txt index 33011c08e9..43b56d7844 100644 --- a/docs/ref/settings.txt +++ b/docs/ref/settings.txt @@ -1698,6 +1698,19 @@ and ``NUMBER_GROUPING`` from current locale, to format the number. See also ``THOUSAND_SEPARATOR`` and ``NUMBER_GROUPING``. +.. setting:: USE_X_FORWARDED_HOST + +USE_X_FORWARDED_HOST +-------------------- + +.. versionadded:: 1.3.1 + +Default: ``False`` + +A boolean that specifies whether to use the X-Forwarded-Host header in +preference to the Host header. This should only be enabled if a proxy +which sets this header is in use. + .. setting:: YEAR_MONTH_FORMAT YEAR_MONTH_FORMAT |