Commit 340c410d authored by Tim Graham's avatar Tim Graham
Browse files

[1.8.x] Fixed #25048 -- Documented that runservers strips headers with underscores.

refs 316b8d49

Backport of 7b6d3104 from master
parent fe367db3
Loading
Loading
Loading
Loading
+6 −0
Original line number Diff line number Diff line
@@ -170,6 +170,12 @@ All attributes should be considered read-only, unless stated otherwise below.
    header called ``X-Bender`` would be mapped to the ``META`` key
    ``HTTP_X_BENDER``.

    Note that :djadmin:`runserver` strips all headers with underscores in the
    name, so you won't see them in ``META``. This prevents header-spoofing
    based on ambiguity between underscores and dashes both being normalizing to
    underscores in WSGI environment variables. It matches the behavior of
    Web servers like Nginx and Apache 2.4+.

.. attribute:: HttpRequest.user

    An object of type :setting:`AUTH_USER_MODEL` representing the currently