#27575: Make host validation run on all requests
--------------------------------------+------------------------------------
Reporter: JorisBenschop | Owner: (none)
Type: Cleanup/optimization | Status: new
Component: HTTP handling | Version: 1.10
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
--------------------------------------+------------------------------------
Changes (by Chris Jerdonek):
* owner: Ketan Bhatt => (none)
* status: assigned => new
Comment:
Tim, what were you envisioning for this ticket? In particular, were you
envisioning a backwards incompatible change?
Also, something weaker than requiring it to be run for all Django installs
for all requests would be to ensure that it runs for all requests only
when any of certain middleware is enabled. That initial list of middleware
could include e.g. any middleware that currently calls
`HttpRequest.get_host()` under certain conditions (e.g.
`CsrfViewMiddleware`). That approach would at least let middleware call it
without needing to handle `DisallowedHost` everywhere, because those
middleware could each be updated to call it at the beginning if it hasn't
been called yet (and then caching the value for later middleware).
--
Ticket URL: <https://code.djangoproject.com/ticket/27575#comment:14>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/071.49a4bacae2e6bdfaac6ee8a6b084358c%40djangoproject.com.
