... ヘッダー・スプーフィングが防がれます。この動作は、Nginx や Apache 2.4+ のようなウェブサーバーと一致しています。 HttpRequest.headers は CONTENT_LENGTH と CONTENT_TYPE を含む、全てのHTTPプレフィックス付きヘッダーにアクセスするより簡単な方法です。 HttpReque ... st. headers [ソース] ¶ リクエストからHTTPプリフィックスヘッダー全体 ( Content-Length と Content-Type を含む) にアクセスを提供する、大文 ... にタイトルケース (例: User-Agent ) でスタイリズされます。ヘッダーは大文字小文字を区別せずにアクセスできます。 >>> request . headers {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6', ...)} >>> "User-Agent" in request . headers True >>> "use ... ... ヘッダー・スプーフィングが防がれます。この動作は、Nginx や Apache 2.4+ のようなウェブサーバーと一致しています。 HttpRequest.headers は CONTENT_LENGTH と CONTENT_TYPE を含む、全てのHTTPプレフィックス付きヘッダーにアクセスするより簡単な方法です。 HttpReque ... st. headers [ソース] ¶ リクエストからHTTPプリフィックスヘッダー全体 ( Content-Length と Content-Type を含む) にアクセスを提供する、大文 ... にタイトルケース (例: User-Agent ) でスタイリズされます。ヘッダーは大文字小文字を区別せずにアクセスできます。 >>> request . headers {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6', ...)} >>> "User-Agent" in request . headers True >>> "use ... ... ity "low" according to the Django security policy . CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI ¶ When receiving duplicates of a single header, ASGIRequest allowed a remote attacker to cause a potential ... denial-of-service via a specifically created request with multiple duplicate headers. The vulnerability resulted from repeated string concatenation while combining repeated headers, which produced super-line ... iming difference in mod_wsgi authentication handler CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI CVE-2026-1207: Potential SQL injection via raster lookups on PostGIS CVE-2026-1285: Potential denial-of-se ... ... ity "low" according to the Django security policy . CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI ¶ When receiving duplicates of a single header, ASGIRequest allowed a remote attacker to cause a potential ... denial-of-service via a specifically created request with multiple duplicate headers. The vulnerability resulted from repeated string concatenation while combining repeated headers, which produced super-line ... iming difference in mod_wsgi authentication handler CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI CVE-2026-1207: Potential SQL injection via raster lookups on PostGIS CVE-2026-1285: Potential denial-of-se ... ... ity "low" according to the Django security policy . CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI ¶ When receiving duplicates of a single header, ASGIRequest allowed a remote attacker to cause a potential ... denial-of-service via a specifically created request with multiple duplicate headers. The vulnerability resulted from repeated string concatenation while combining repeated headers, which produced super-line ... iming difference in mod_wsgi authentication handler CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI CVE-2026-1207: Potential SQL injection via raster lookups on PostGIS CVE-2026-1285: Potential denial-of-se ... ... ity "low" according to the Django security policy . CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI ¶ When receiving duplicates of a single header, ASGIRequest allowed a remote attacker to cause a potential ... denial-of-service via a specifically created request with multiple duplicate headers. The vulnerability resulted from repeated string concatenation while combining repeated headers, which produced super-line ... iming difference in mod_wsgi authentication handler CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI CVE-2026-1207: Potential SQL injection via raster lookups on PostGIS CVE-2026-1285: Potential denial-of-se ... ... ます。 class Client ( enforce_csrf_checks = False , raise_request_exception = True , json_encoder = DjangoJSONEncoder , * , headers = None , query_params = None , ** defaults ) [ソース] ¶ テスト用の HTTP クライアントです。いくつかの引数で動作をカスタマイ ... ズできます。 headers にはリクエストごとに送信されるデフォルトのヘッダを指定できます。例えば、 User-Agent ヘッダの場合: client = Client ( header ... nt ( SCRIPT_NAME = "/app/" ) 注釈 HTTP_ プレフィックスで始まるキーワード引数がヘッダーとして設定されますが、可読性のために headers パラメーターの使用を推奨します。 The values from the headers , query_params , and extra keyword arguments passed to get() ... ... .4.17 release. WSGI header spoofing via underscore/dash conflation ¶ When HTTP headers are placed into the WSGI environ, they are normalized by conver ... thus also in Django's request.META dictionary). Unfortunately, this means that the WSGI environ cannot distinguish between headers containing dashes and headers containing underscores: X-Auth-User and X-Auth_User both become HTTP_X_AUTH_USER . This mean ... eader (with underscore) and bypass this protection. In order to prevent such attacks, both Nginx and Apache 2.4+ strip all headers containing underscores from incoming requests by default. Django's built-in development server now does the same. Django's ... ... ation ¶ When HTTP headers are placed into the WSGI environ, they are normalized by converting to uppercase, converting all dashes to underscores, an ... thus also in Django's request.META dictionary). Unfortunately, this means that the WSGI environ cannot distinguish between headers containing dashes and headers containing underscores: X-Auth-User and X-Auth_User both become HTTP_X_AUTH_USER . This mean ... eader (with underscore) and bypass this protection. In order to prevent such attacks, both Nginx and Apache 2.4+ strip all headers containing underscores from incoming requests by default. Django's built-in development server now does the same. Django's ... ... ます。 class Client ( enforce_csrf_checks = False , raise_request_exception = True , json_encoder = DjangoJSONEncoder , * , headers = None , query_params = None , ** defaults ) [ソース] ¶ テスト用の HTTP クライアントです。いくつかの引数で動作をカスタマイ ... ズできます。 headers にはリクエストごとに送信されるデフォルトのヘッダを指定できます。例えば、 User-Agent ヘッダの場合: client = Client ( header ... nt ( SCRIPT_NAME = "/app/" ) 注釈 HTTP_ プレフィックスで始まるキーワード引数がヘッダーとして設定されますが、可読性のために headers パラメーターの使用を推奨します。 The values from the headers , query_params , and extra keyword arguments passed to get() ... 2026年10月08日