diff options
| author | René Fleschenberg <rene@fleschenberg.net> | 2019-09-10 17:35:36 +0200 |
|---|---|---|
| committer | Mariusz Felisiak <felisiak.mariusz@gmail.com> | 2019-10-11 15:30:33 +0200 |
| commit | d232fd76a85870daf345fd8f8d617fe7802ae194 (patch) | |
| tree | 3bf13b49472c48ebf77744e4659a1772a18518fa /docs | |
| parent | e7cdb0cd7eb5eb677af8dae7bfc6845186f861b0 (diff) | |
Clarified that SECURE_REDIRECT_EXEMPT patterns should not include leading slashes.
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/ref/settings.txt | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/docs/ref/settings.txt b/docs/ref/settings.txt index 4405d152b2..dac9502abb 100644 --- a/docs/ref/settings.txt +++ b/docs/ref/settings.txt @@ -2306,8 +2306,11 @@ available in ``request.META``.) Default: ``[]`` (Empty list) If a URL path matches a regular expression in this list, the request will not be -redirected to HTTPS. If :setting:`SECURE_SSL_REDIRECT` is ``False``, this -setting has no effect. +redirected to HTTPS. The +:class:`~django.middleware.security.SecurityMiddleware` strips leading slashes +from URL paths, so patterns shouldn't include them, e.g. +``SECURE_REDIRECT_EXEMPT = [r'^no-ssl/$', …]``. If +:setting:`SECURE_SSL_REDIRECT` is ``False``, this setting has no effect. .. setting:: SECURE_REFERRER_POLICY |