Ticket #6880: 6880.diff

docs/ref/request-response.txt

@@ -191 +191 @@
 
 .. method:: HttpRequest.get_host()
 
-    Returns the originating host of the request using information from the
-    ``HTTP_X_FORWARDED_HOST`` and ``HTTP_HOST`` headers (in that order). If
-    they don't provide a value, the method uses a combination of
+    Returns the host of the request using information from the ``HTTP_HOST``
+    header. If it does not provide a value, the method uses a combination of
     ``SERVER_NAME`` and ``SERVER_PORT`` as detailed in `PEP 333`_.
 
     .. _PEP 333: http://www.python.org/dev/peps/pep-0333/
 
     Example: ``"127.0.0.1:8000"``
 
-    .. note:: The :meth:`~HttpRequest.get_host()` method fails when the host is
-        behind multiple proxies. One solution is to use middleware to rewrite
-        the proxy headers, as in the following example::
+    .. note:: :meth:`~HttpRequest.get_host()` returns the address of the
+        closest proxy when the host is behind one or several proxies.
+        This is transparent with reverse-proxies that rewrite both the
+        ``Host`` header in requests and the ``Location``, ``Content-Location``
+        and ``URI`` headers in responses, including Apache's ``mod_proxy`` and
+        Squid.
 
-            class MultipleProxyMiddleware(object):
-                FORWARDED_FOR_FIELDS = [
-                    'HTTP_X_FORWARDED_FOR',
-                    'HTTP_X_FORWARDED_HOST',
-                    'HTTP_X_FORWARDED_SERVER',
-                ]
+    .. versionchanged:: 1.3
 
-                def process_request(self, request):
-                    """
-                    Rewrites the proxy headers so that only the most
-                    recent proxy is used.
-                    """
-                    for field in self.FORWARDED_FOR_FIELDS:
-                        if field in request.META:
-                            if ',' in request.META[field]:
-                                parts = request.META[field].split(',')
-                                request.META[field] = parts[-1].strip()
 
+    :meth:`~HttpRequest.get_host()` used to interpret the non-standard
+    ``HTTP_X_FORWARDED_HOST`` header to determine the originating host.
+    This failed when the host was behind multiple proxies or when a proxy
+    switched between HTTP and HTTPS and was removed.
 
 .. method:: HttpRequest.get_full_path()
 

django/http/__init__.py

@@ -128 +128 @@
     def get_host(self):
         """Returns the HTTP host using the environment or request headers."""
         # We try three options, in order of decreasing preference.
-        if 'HTTP_X_FORWARDED_HOST' in self.META:
-            host = self.META['HTTP_X_FORWARDED_HOST']
-        elif 'HTTP_HOST' in self.META:
+        if 'HTTP_HOST' in self.META:
             host = self.META['HTTP_HOST']
         else:
             # Reconstruct the host using the algorithm from PEP 333.