#27506: HttpRequest.build_absolute_uri throws DisallowedHost
-------------------------------------+-------------------------------------
Reporter: Daniel Hahler | Owner: nobody
Type: | Status: closed
Cleanup/optimization |
Component: HTTP handling | Version: 1.10
Severity: Normal | Resolution: invalid
Keywords: | Triage Stage:
| Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Changes (by Florian Apolloner):
* status: new => closed
* resolution: => invalid
Comment:
> I've noticed that using HttpRequest.build_absolute_uri() might throw
DisallowedHost, which looks like an unexpected side effect.
I'd call it "works as designed" :D The main idea here is that you need
`get_host` and `build_absolute_uri` ''usually'' in cases where you are
sending emails or providing redirect urls for other sites/apis. And those
are generally the cases where you'd want to ensure that you do not allow
invalid hosts. So by default this is an important defense line and should
stay on.
To allow access to the unvetted URI we've added ''get_raw_uri'' which
should work in your case -- I am closing the ticket as invalid, please
reopen if you have any questions there.
--
Ticket URL: <https://code.djangoproject.com/ticket/27506#comment:3>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/065.23af72eeafe037a8b69b94d368a57a30%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
