... d features in the 1.1 branch, see the Django 1.1 リリースノート . Backwards incompatible changes ¶ CSRF exception for AJAX requests ¶ Django includes a CSRF-protection mechanism, which makes use of a token inserted into outgoing forms. Middleware then ch ... ken's presence on form submission, and validates it. Prior to Django 1.2.5, our CSRF protection made an exception for AJAX requests, on the following basis: Many AJAX toolkits add an X-Requested-With header when using XMLHttpRequest. Browsers have strict ... tom header of this nature can be added is with XMLHttpRequest. Therefore, for ease of use, we did not apply CSRF checks to requests that appeared to be AJAX on the basis of the X-Requested-With header. The Ruby on Rails web framework had a similar exempt ... ... d features in the 1.1 branch, see the Django 1.1 リリースノート . Backwards incompatible changes ¶ CSRF exception for AJAX requests ¶ Django includes a CSRF-protection mechanism, which makes use of a token inserted into outgoing forms. Middleware then ch ... ken's presence on form submission, and validates it. Prior to Django 1.2.5, our CSRF protection made an exception for AJAX requests, on the following basis: Many AJAX toolkits add an X-Requested-With header when using XMLHttpRequest. Browsers have strict ... tom header of this nature can be added is with XMLHttpRequest. Therefore, for ease of use, we did not apply CSRF checks to requests that appeared to be AJAX on the basis of the X-Requested-With header. The Ruby on Rails web framework had a similar exempt ... ... oyed behind a reverse-proxy connecting to Django via HTTPS, django.http.HttpRequest.scheme would incorrectly detect client requests made via HTTP as using HTTPS. This entails incorrect results for is_secure() , and build_absolute_uri() , and that HTTP re ... s SECURE_PROXY_SSL_HEADER , if it is configured, and the appropriate header is set on the request, for both HTTP and HTTPS requests. If you deploy Django behind a reverse-proxy that forwards HTTP requests, and that connects to Django via HTTPS, be sure t ... necting via HTTPS 前のトピックへ Django 1.11.23 リリースノート 次のトピックへ Django 1.11.21 リリースノート 関連キーワード requests reverse proxy scheme connecting behind HttpRequest build absolute リリースノート July fixes security issue Incorrect detec ... ... oyed behind a reverse-proxy connecting to Django via HTTPS, django.http.HttpRequest.scheme would incorrectly detect client requests made via HTTP as using HTTPS. This entails incorrect results for is_secure() , and build_absolute_uri() , and that HTTP re ... s SECURE_PROXY_SSL_HEADER , if it is configured, and the appropriate header is set on the request, for both HTTP and HTTPS requests. If you deploy Django behind a reverse-proxy that forwards HTTP requests, and that connects to Django via HTTPS, be sure t ... connecting via HTTPS 前のトピックへ Django 2.1.11 リリースノート 次のトピックへ Django 2.1.9 リリースノート 関連キーワード requests reverse proxy scheme connecting behind HttpRequest build absolute リリースノート July fixes security issue Incorrect detec ... ... d features in the 1.2 branch, see the Django 1.2 リリースノート . Backwards incompatible changes ¶ CSRF exception for AJAX requests ¶ Django includes a CSRF-protection mechanism, which makes use of a token inserted into outgoing forms. Middleware then ch ... ken's presence on form submission, and validates it. Prior to Django 1.2.5, our CSRF protection made an exception for AJAX requests, on the following basis: Many AJAX toolkits add an X-Requested-With header when using XMLHttpRequest. Browsers have strict ... tom header of this nature can be added is with XMLHttpRequest. Therefore, for ease of use, we did not apply CSRF checks to requests that appeared to be AJAX on the basis of the X-Requested-With header. The Ruby on Rails web framework had a similar exempt ... ... d features in the 1.2 branch, see the Django 1.2 リリースノート . Backwards incompatible changes ¶ CSRF exception for AJAX requests ¶ Django includes a CSRF-protection mechanism, which makes use of a token inserted into outgoing forms. Middleware then ch ... ken's presence on form submission, and validates it. Prior to Django 1.2.5, our CSRF protection made an exception for AJAX requests, on the following basis: Many AJAX toolkits add an X-Requested-With header when using XMLHttpRequest. Browsers have strict ... tom header of this nature can be added is with XMLHttpRequest. Therefore, for ease of use, we did not apply CSRF checks to requests that appeared to be AJAX on the basis of the X-Requested-With header. The Ruby on Rails web framework had a similar exempt ... ... oyed behind a reverse-proxy connecting to Django via HTTPS, django.http.HttpRequest.scheme would incorrectly detect client requests made via HTTP as using HTTPS. This entails incorrect results for is_secure() , and build_absolute_uri() , and that HTTP re ... s SECURE_PROXY_SSL_HEADER , if it is configured, and the appropriate header is set on the request, for both HTTP and HTTPS requests. If you deploy Django behind a reverse-proxy that forwards HTTP requests, and that connects to Django via HTTPS, be sure t ... HTTPS 前のトピックへ Django 1.11.23 リリースノート 次のトピックへ Django 1.11.21 リリースノート 関連キーワード Django via requests reverse proxy scheme connecting behind HttpRequest build absolute uri リリースノート July fixes security issue Incorrect d ... ... oyed behind a reverse-proxy connecting to Django via HTTPS, django.http.HttpRequest.scheme would incorrectly detect client requests made via HTTP as using HTTPS. This entails incorrect results for is_secure() , and build_absolute_uri() , and that HTTP re ... s SECURE_PROXY_SSL_HEADER , if it is configured, and the appropriate header is set on the request, for both HTTP and HTTPS requests. If you deploy Django behind a reverse-proxy that forwards HTTP requests, and that connects to Django via HTTPS, be sure t ... via HTTPS 前のトピックへ Django 2.1.11 リリースノート 次のトピックへ Django 2.1.9 リリースノート 関連キーワード Django via requests reverse proxy scheme connecting behind HttpRequest build absolute uri リリースノート July fixes security issue Incorrect d ... ... oyed behind a reverse-proxy connecting to Django via HTTPS, django.http.HttpRequest.scheme would incorrectly detect client requests made via HTTP as using HTTPS. This entails incorrect results for is_secure() , and build_absolute_uri() , and that HTTP re ... s SECURE_PROXY_SSL_HEADER , if it is configured, and the appropriate header is set on the request, for both HTTP and HTTPS requests. If you deploy Django behind a reverse-proxy that forwards HTTP requests, and that connects to Django via HTTPS, be sure t ... ng via HTTPS バグ修正 前のトピックへ Django 2.2.4 リリースノート 次のトピックへ Django 2.2.2 リリースノート 関連キーワード requests reverse proxy scheme connecting behind HttpRequest using build absolute Fixed regression リリースノート July fixes securit ... ... f-service vulnerability in ASGI requests via file upload limit bypass ¶ ASGI requests with a missing or understated Content-Length header could bypass the FILE_UPL ... due to incorrect handling of Vary: * in UpdateCacheMiddleware ¶ Previously, UpdateCacheMiddleware would erroneously cache requests where the Vary header contained an asterisk ( '*' ). This could lead to private data being stored and served. This issue h ... Django security policy . 目次 Django 5.2.14 release notes CVE-2026-5766: Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass CVE-2026-35192: Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST CVE-2 ... 2026年10月08日