diff options
Diffstat (limited to 'docs/ref/settings.txt')
| -rw-r--r-- | docs/ref/settings.txt | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/docs/ref/settings.txt b/docs/ref/settings.txt index 382ce2edfc..d6f6e7c937 100644 --- a/docs/ref/settings.txt +++ b/docs/ref/settings.txt @@ -108,14 +108,18 @@ If the ``Host`` header (or ``X-Forwarded-Host`` if list, the :meth:`django.http.HttpRequest.get_host()` method will raise :exc:`~django.core.exceptions.SuspiciousOperation`. -When :setting:`DEBUG` is ``True`` or when running tests, host validation is -disabled; any host will be accepted. Thus it's usually only necessary to set it -in production. +When :setting:`DEBUG` is ``True`` and ``ALLOWED_HOSTS`` is empty, the host +is validated against ``['localhost', '127.0.0.1', '[::1]']``. This validation only applies via :meth:`~django.http.HttpRequest.get_host()`; if your code accesses the ``Host`` header directly from ``request.META`` you are bypassing this security protection. +.. versionchanged:: 1.8.16 + + In older versions, ``ALLOWED_HOSTS`` wasn't checked if ``DEBUG=True``, but + it's now checked to prevent a DNS rebinding attack. + .. setting:: ALLOWED_INCLUDE_ROOTS ALLOWED_INCLUDE_ROOTS |