... fing via underscore/hyphen conflation ¶ ASGIRequest normalizes header names following WSGI conventions, mapping hyphens to underscores. As a result, even in configurations where reverse proxies carefully strip security-sensitive headers named with hyphens, ... such a header could be spoofed by supplying a header named with underscores. Under WSGI, it is the responsibility of the server or proxy to avoid ambiguous mappings. (Django's runserver was patched ... t the same uniform expectation, even if many proxies protect against this under default configuration (including nginx via underscores_in_headers off; ). Headers containing underscores are now ignored by ASGIRequest , matching the behavior of Daphne , the r ... ... fing via underscore/hyphen conflation ¶ ASGIRequest normalizes header names following WSGI conventions, mapping hyphens to underscores. As a result, even in configurations where reverse proxies carefully strip security-sensitive headers named with hyphens, ... such a header could be spoofed by supplying a header named with underscores. Under WSGI, it is the responsibility of the server or proxy to avoid ambiguous mappings. (Django's runserver was patched ... t the same uniform expectation, even if many proxies protect against this under default configuration (including nginx via underscores_in_headers off; ). Headers containing underscores are now ignored by ASGIRequest , matching the behavior of Daphne , the r ... ... fing via underscore/hyphen conflation ¶ ASGIRequest normalizes header names following WSGI conventions, mapping hyphens to underscores. As a result, even in configurations where reverse proxies carefully strip security-sensitive headers named with hyphens, ... such a header could be spoofed by supplying a header named with underscores. Under WSGI, it is the responsibility of the server or proxy to avoid ambiguous mappings. (Django's runserver was patched ... t the same uniform expectation, even if many proxies protect against this under default configuration (including nginx via underscores_in_headers off; ). Headers containing underscores are now ignored by ASGIRequest , matching the behavior of Daphne , the r ... ... fing via underscore/hyphen conflation ¶ ASGIRequest normalizes header names following WSGI conventions, mapping hyphens to underscores. As a result, even in configurations where reverse proxies carefully strip security-sensitive headers named with hyphens, ... such a header could be spoofed by supplying a header named with underscores. Under WSGI, it is the responsibility of the server or proxy to avoid ambiguous mappings. (Django's runserver was patched ... t the same uniform expectation, even if many proxies protect against this under default configuration (including nginx via underscores_in_headers off; ). Headers containing underscores are now ignored by ASGIRequest , matching the behavior of Daphne , the r ... ... fing via underscore/hyphen conflation ¶ ASGIRequest normalizes header names following WSGI conventions, mapping hyphens to underscores. As a result, even in configurations where reverse proxies carefully strip security-sensitive headers named with hyphens, ... such a header could be spoofed by supplying a header named with underscores. Under WSGI, it is the responsibility of the server or proxy to avoid ambiguous mappings. (Django's runserver was patched ... t the same uniform expectation, even if many proxies protect against this under default configuration (including nginx via underscores_in_headers off; ). Headers containing underscores are now ignored by ASGIRequest , matching the behavior of Daphne , the r ... ... fing via underscore/hyphen conflation ¶ ASGIRequest normalizes header names following WSGI conventions, mapping hyphens to underscores. As a result, even in configurations where reverse proxies carefully strip security-sensitive headers named with hyphens, ... such a header could be spoofed by supplying a header named with underscores. Under WSGI, it is the responsibility of the server or proxy to avoid ambiguous mappings. (Django's runserver was patched ... t the same uniform expectation, even if many proxies protect against this under default configuration (including nginx via underscores_in_headers off; ). Headers containing underscores are now ignored by ASGIRequest , matching the behavior of Daphne , the r ... ... en HTTP headers are placed into the WSGI environ, they are normalized by converting to uppercase, converting all dashes to underscores, and prepending HTTP_ . For instance, a header X-Auth-User would become HTTP_X_AUTH_USER in the WSGI environ (and thus als ... nfortunately, this means that the WSGI environ cannot distinguish between headers containing dashes and headers containing underscores: X-Auth-User and X-Auth_User both become HTTP_X_AUTH_USER . This means that if a header is used in a security-sensitive wa ... ore) and bypass this protection. In order to prevent such attacks, both Nginx and Apache 2.4+ strip all headers containing underscores from incoming requests by default. Django's built-in development server now does the same. Django's development server is ... ... en HTTP headers are placed into the WSGI environ, they are normalized by converting to uppercase, converting all dashes to underscores, and prepending HTTP_ . For instance, a header X-Auth-User would become HTTP_X_AUTH_USER in the WSGI environ (and thus als ... nfortunately, this means that the WSGI environ cannot distinguish between headers containing dashes and headers containing underscores: X-Auth-User and X-Auth_User both become HTTP_X_AUTH_USER . This means that if a header is used in a security-sensitive wa ... ore) and bypass this protection. In order to prevent such attacks, both Nginx and Apache 2.4+ strip all headers containing underscores from incoming requests by default. Django's built-in development server now does the same. Django's development server is ... ... en HTTP headers are placed into the WSGI environ, they are normalized by converting to uppercase, converting all dashes to underscores, and prepending HTTP_ . For instance, a header X-Auth-User would become HTTP_X_AUTH_USER in the WSGI environ (and thus als ... nfortunately, this means that the WSGI environ cannot distinguish between headers containing dashes and headers containing underscores: X-Auth-User and X-Auth_User both become HTTP_X_AUTH_USER . This means that if a header is used in a security-sensitive wa ... ore) and bypass this protection. In order to prevent such attacks, both Nginx and Apache 2.4+ strip all headers containing underscores from incoming requests by default. Django's built-in development server now does the same. Django's development server is ... ... en HTTP headers are placed into the WSGI environ, they are normalized by converting to uppercase, converting all dashes to underscores, and prepending HTTP_ . For instance, a header X-Auth-User would become HTTP_X_AUTH_USER in the WSGI environ (and thus als ... nfortunately, this means that the WSGI environ cannot distinguish between headers containing dashes and headers containing underscores: X-Auth-User and X-Auth_User both become HTTP_X_AUTH_USER . This means that if a header is used in a security-sensitive wa ... ore) and bypass this protection. In order to prevent such attacks, both Nginx and Apache 2.4+ strip all headers containing underscores from incoming requests by default. Django's built-in development server now does the same. Django's development server is ... 2026年10月08日