diff options
Diffstat (limited to 'docs/ref')
| -rw-r--r-- | docs/ref/checks.txt | 5 | ||||
| -rw-r--r-- | docs/ref/clickjacking.txt | 12 | ||||
| -rw-r--r-- | docs/ref/settings.txt | 5 |
3 files changed, 15 insertions, 7 deletions
diff --git a/docs/ref/checks.txt b/docs/ref/checks.txt index 88b09b008d..4da932720e 100644 --- a/docs/ref/checks.txt +++ b/docs/ref/checks.txt @@ -420,9 +420,8 @@ The following checks are run if you use the :option:`check --deploy` option: * **security.W019**: You have :class:`django.middleware.clickjacking.XFrameOptionsMiddleware` in your :setting:`MIDDLEWARE`, but :setting:`X_FRAME_OPTIONS` is not set to - ``'DENY'``. The default is ``'SAMEORIGIN'``, but unless there is a good reason - for your site to serve other parts of itself in a frame, you should change - it to ``'DENY'``. + ``'DENY'``. Unless there is a good reason for your site to serve other parts + of itself in a frame, you should change it to ``'DENY'``. * **security.W020**: :setting:`ALLOWED_HOSTS` must not be empty in deployment. * **security.W021**: You have not set the :setting:`SECURE_HSTS_PRELOAD` setting to ``True``. Without this, your site diff --git a/docs/ref/clickjacking.txt b/docs/ref/clickjacking.txt index 88b45fd63b..c7cac17ca4 100644 --- a/docs/ref/clickjacking.txt +++ b/docs/ref/clickjacking.txt @@ -67,10 +67,15 @@ This middleware is enabled in the settings file generated by :djadmin:`startproject`. By default, the middleware will set the ``X-Frame-Options`` header to -``SAMEORIGIN`` for every outgoing ``HttpResponse``. If you want ``DENY`` -instead, set the :setting:`X_FRAME_OPTIONS` setting:: +``DENY`` for every outgoing ``HttpResponse``. If you want any other value for +this header instead, set the :setting:`X_FRAME_OPTIONS` setting:: - X_FRAME_OPTIONS = 'DENY' + X_FRAME_OPTIONS = 'SAMEORIGIN' + +.. versionchanged:: 3.0 + + The default value of the :setting:`X_FRAME_OPTIONS` setting was changed + from ``SAMEORIGIN`` to ``DENY``. When using the middleware there may be some views where you do **not** want the ``X-Frame-Options`` header set. For those cases, you can use a view decorator @@ -116,6 +121,7 @@ Browsers that support ``X-Frame-Options`` ----------------------------------------- * Internet Explorer 8+ +* Edge * Firefox 3.6.9+ * Opera 10.5+ * Safari 4+ diff --git a/docs/ref/settings.txt b/docs/ref/settings.txt index 493d99e92a..aa9bc1ddb8 100644 --- a/docs/ref/settings.txt +++ b/docs/ref/settings.txt @@ -2795,12 +2795,15 @@ and :setting:`MONTH_DAY_FORMAT`. ``X_FRAME_OPTIONS`` ------------------- -Default: ``'SAMEORIGIN'`` +Default: ``'DENY'`` The default value for the X-Frame-Options header used by :class:`~django.middleware.clickjacking.XFrameOptionsMiddleware`. See the :doc:`clickjacking protection </ref/clickjacking/>` documentation. +.. versionchanged:: 3.0 + + In older versions, the default value is ``SAMEORIGIN``. Auth ==== |