Ticket #25048: 25048.diff

File 25048.diff, 839 bytes (added by Tim Graham, 9 years ago)

  • docs/ref/request-response.txt 

    diff --git a/docs/ref/request-response.txt b/docs/ref/request-response.txt
index fbc83bc..11344b6 100644
    a b All attributes should be considered read-only, unless stated otherwise below.  
    153153    header called ``X-Bender`` would be mapped to the ``META`` key
    154154    ``HTTP_X_BENDER``.
    155155
     156    Django's :djadmin:`runserver` strips all headers with underscores in the
     157    name, so you won't see them in ``META``. This prevents header-spoofing
     158    based on ambiguity between underscores and dashes both being normalizing to
     159    underscores in WSGI environment variables. It matches the behavior of
     160    Web servers like Nginx and Apache 2.4+.
     161
    156162.. attribute:: HttpRequest.user
    157163
    158164    An object of type :setting:`AUTH_USER_MODEL` representing the currently
Back to Top