From adb96617897690b3a01e39e8297ae7d67825d2bc Mon Sep 17 00:00:00 2001 From: Gordon Pendleton Date: Sat, 23 Nov 2019 21:17:31 -0500 Subject: Fixed #31010 -- Allowed subdomains of localhost in the Host header by default when DEBUG=True. --- docs/ref/settings.txt | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'docs/ref') diff --git a/docs/ref/settings.txt b/docs/ref/settings.txt index 6c8ea9b762..3c360cf284 100644 --- a/docs/ref/settings.txt +++ b/docs/ref/settings.txt @@ -90,7 +90,7 @@ list, the :meth:`django.http.HttpRequest.get_host()` method will raise :exc:`~django.core.exceptions.SuspiciousOperation`. When :setting:`DEBUG` is ``True`` and ``ALLOWED_HOSTS`` is empty, the host -is validated against ``['localhost', '127.0.0.1', '[::1]']``. +is validated against ``['.localhost', '127.0.0.1', '[::1]']``. ``ALLOWED_HOSTS`` is also :ref:`checked when running tests `. @@ -99,6 +99,11 @@ This validation only applies via :meth:`~django.http.HttpRequest.get_host()`; if your code accesses the ``Host`` header directly from ``request.META`` you are bypassing this security protection. +.. versionchanged:: 3.1 + + If ``ALLOWED_HOSTS`` is empty and ``DEBUG=True``, subdomains of localhost + were allowed. + .. setting:: APPEND_SLASH ``APPEND_SLASH`` -- cgit v1.3