Changes between Initial Version and Version 1 of Ticket #37025, comment 9


Ignore:
Timestamp:
Apr 9, 2026, 3:03:02 PM (3 weeks ago)
Author:
Jacob Walls

Legend:

Unmodified
Added
Removed
Modified

  • Ticket #37025, comment 9

    initial v1  
    1515
    1616
    17 When those test cases run, the client sends `HTTP_AUTHUSER = ...`, so `request.META` gets `HTTP_HTTP_AUTHUSER`.
     17When those test cases run, the async client sends `HTTP_AUTHUSER = ...`, so `request.META` gets `HTTP_HTTP_AUTHUSER`.
    1818
    19 That doesn't look right, and I doubt anybody is doing this, so I was interested to discuss a code change. However, a better idea than forcing ASGI projects to subclass the middleware would be to perform the lookup against `self.headers`, which already supports lookups by unprefixed header names. This is a little more defensible to document, I feel. The only behavior change would be that an ASGI-only project could now set `header = "WITH-HYPHENS"` and benefit from a more flexible lookup, which is backward compatible.
     19That doesn't look right, and I doubt anybody is doing this, so I was interested to discuss a code change. However, a better idea than forcing ASGI projects to subclass the middleware would be to perform the lookup against `request.headers`, which already supports lookups by unprefixed header names. This is a little more defensible to document, I feel. The only behavior change would be that an ASGI-only project could now set `header = "WITH-HYPHENS"` and benefit from a more flexible lookup, which is backward compatible.
    2020
    2121On the security list, Jake suggested roughly, "If we're doing a deprecation, let's change both WSGI/ASGI paths to use `self.headers` to have consistency". I think we can punt on whether to do a deprecation here, and just start with the docs fix paired with the more flexible lookup. I'll put up a PR to aid triage.
Back to Top