diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/releases/1.11.txt | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/docs/releases/1.11.txt b/docs/releases/1.11.txt index d62ea80e8c..64afe7a841 100644 --- a/docs/releases/1.11.txt +++ b/docs/releases/1.11.txt @@ -356,6 +356,13 @@ to assign a free port. The ``DJANGO_LIVE_TEST_SERVER_ADDRESS`` environment variable is no longer used, and as it's also no longer used, the ``manage.py test --liveserver`` option is removed. +Protection against insecure redirects in :mod:`django.contrib.auth` views +------------------------------------------------------------------------- + +``LoginView`` and ``LogoutView`` (and the deprecated function-based equivalents) +protect users from being redirected to non-HTTPS ``next`` URLs when the app +is running over HTTPS. + Miscellaneous ------------- |