... t of end-user-written applications -- make use of full URLs, including domain name, which are generated from the HTTP Host header. Some attacks against this are beyond Django's ability to control, and require the web server to be properly configured; D ... entation has for some time contained notes advising users on such configuration. Django's own built-in parsing of the Host header is, however, still vulnerable, as was reported to us recently. The Host header parsing in Django 1.3.3 and Django 1.4.1 -- ... specifically, django.http.HttpRequest.get_host() -- was incorrectly handling username/password information in the header. Thus, for example, the following Host header would be accepted by Django when running on validsite.com : Host: validsite. ... ... t of end-user-written applications -- make use of full URLs, including domain name, which are generated from the HTTP Host header. Some attacks against this are beyond Django's ability to control, and require the web server to be properly configured; D ... entation has for some time contained notes advising users on such configuration. Django's own built-in parsing of the Host header is, however, still vulnerable, as was reported to us recently. The Host header parsing in Django 1.3.3 and Django 1.4.1 -- ... specifically, django.http.HttpRequest.get_host() -- was incorrectly handling username/password information in the header. Thus, for example, the following Host header would be accepted by Django when running on validsite.com : Host: validsite. ... ... t of end-user-written applications -- make use of full URLs, including domain name, which are generated from the HTTP Host header. Some attacks against this are beyond Django's ability to control, and require the web server to be properly configured; D ... entation has for some time contained notes advising users on such configuration. Django's own built-in parsing of the Host header is, however, still vulnerable, as was reported to us recently. The Host header parsing in Django 1.3.3 and Django 1.4.1 -- ... specifically, django.http.HttpRequest.get_host() -- was incorrectly handling username/password information in the header. Thus, for example, the following Host header would be accepted by Django when running on validsite.com : Host: validsite. ... ... t of end-user-written applications -- make use of full URLs, including domain name, which are generated from the HTTP Host header. Some attacks against this are beyond Django's ability to control, and require the web server to be properly configured; D ... entation has for some time contained notes advising users on such configuration. Django's own built-in parsing of the Host header is, however, still vulnerable, as was reported to us recently. The Host header parsing in Django 1.3.3 and Django 1.4.1 -- ... specifically, django.http.HttpRequest.get_host() -- was incorrectly handling username/password information in the header. Thus, for example, the following Host header would be accepted by Django when running on validsite.com : Host: validsite. ... ... information disclosure and can be a vector for cache poisoning. When using Django sessions, Django will set a Vary: Cookie header to ensure caches do not serve cached data to requests from other sessions. However, older versions of Internet Explorer (m ... ly Internet Explorer 6, and Internet Explorer 7 if run on Windows XP or Windows Server 2003) are unable to handle the Vary header in combination with many content types. Therefore, Django would remove the header if the request was made by Internet Expl ... orer. To remedy this, the special behavior for these older Internet Explorer versions has been removed, and the Vary header is no longer stripped from the response. In addition, modifications to the Cache-Control header for all Internet Explorer ... ... information disclosure and can be a vector for cache poisoning. When using Django sessions, Django will set a Vary: Cookie header to ensure caches do not serve cached data to requests from other sessions. However, older versions of Internet Explorer (m ... ly Internet Explorer 6, and Internet Explorer 7 if run on Windows XP or Windows Server 2003) are unable to handle the Vary header in combination with many content types. Therefore, Django would remove the header if the request was made by Internet Expl ... orer. To remedy this, the special behavior for these older Internet Explorer versions has been removed, and the Vary header is no longer stripped from the response. In addition, modifications to the Cache-Control header for all Internet Explorer ... ... t.META (as REMOTE_USER when supplied as an environment variable, as in WSGI, or HTTP_REMOTE_USER when supplied via an HTTP header, as in ASGI). Django can be configured to make use of the REMOTE_USER value using the RemoteUserMiddleware or PersistentRe ... 。許可したい場合は、 AllowAllUsersRemoteUserBackend を使用してください。 If your authentication mechanism uses a custom HTTP header and not REMOTE_USER , you can subclass RemoteUserMiddleware and set the header attribute to the desired request.META key. ... For example: mysite/middleware.py ¶ from django.contrib.auth.middleware import RemoteUserMiddleware class CustomHeaderRemoteUserMiddleware ( RemoteUserMiddleware ): header = "HTTP_AUTHUSER" このカスタムミドルウェアは、 django.contrib.auth.mi ... ... TTP guide about CSP, see the MDN Guide on CSP . 概要 ¶ The Content-Security-Policy specification defines two complementary headers: Content-Security-Policy : Enforces the CSP policy, blocking content that violates the defined directives. Content-Securi ... of content. When the ContentSecurityPolicyMiddleware is enabled, Django automatically builds and attaches the appropriate headers to each response based on the configured settings , unless they have already been set by another layer. 設定 ¶ The Conten ... . See detailed explanation in Nonce usage . デコレータ ¶ Django provides decorators to control the Content Security Policy headers on a per-view basis. These allow overriding or disabling the enforced or report-only policy for specific views, providing ... ... t.META (as REMOTE_USER when supplied as an environment variable, as in WSGI, or HTTP_REMOTE_USER when supplied via an HTTP header, as in ASGI). Django can be configured to make use of the REMOTE_USER value using the RemoteUserMiddleware or PersistentRe ... 。許可したい場合は、 AllowAllUsersRemoteUserBackend を使用してください。 If your authentication mechanism uses a custom HTTP header and not REMOTE_USER , you can subclass RemoteUserMiddleware and set the header attribute to the desired request.META key. ... For example: mysite/middleware.py ¶ from django.contrib.auth.middleware import RemoteUserMiddleware class CustomHeaderRemoteUserMiddleware ( RemoteUserMiddleware ): header = "HTTP_AUTHUSER" このカスタムミドルウェアは、 django.contrib.auth.mi ... ... TTP guide about CSP, see the MDN Guide on CSP . 概要 ¶ The Content-Security-Policy specification defines two complementary headers: Content-Security-Policy : Enforces the CSP policy, blocking content that violates the defined directives. Content-Securi ... of content. When the ContentSecurityPolicyMiddleware is enabled, Django automatically builds and attaches the appropriate headers to each response based on the configured settings , unless they have already been set by another layer. 設定 ¶ The Conten ... . See detailed explanation in Nonce usage . デコレータ ¶ Django provides decorators to control the Content Security Policy headers on a per-view basis. These allow overriding or disabling the enforced or report-only policy for specific views, providing ... 2026年10月08日