Commit 8b1f39a7 authored by Marissa Zhou's avatar Marissa Zhou Committed by Tim Graham
Browse files

Fixed #24796 -- Added a hint on placement of SecurityMiddleware in MIDDLEWARE_CLASSES. 

Also moved it in the project template.
parent 167a3203

django/conf/project_template/project_name/settings.py

+1 −1
Original line number Diff line number Diff line
@@ -40,6 +40,7 @@ INSTALLED_APPS = [ 
]



MIDDLEWARE_CLASSES = [

    'django.middleware.security.SecurityMiddleware',

    'django.contrib.sessions.middleware.SessionMiddleware',

    'django.middleware.common.CommonMiddleware',

    'django.middleware.csrf.CsrfViewMiddleware',
@@ -47,7 +48,6 @@ MIDDLEWARE_CLASSES = [ 
    'django.contrib.auth.middleware.SessionAuthenticationMiddleware',

    'django.contrib.messages.middleware.MessageMiddleware',

    'django.middleware.clickjacking.XFrameOptionsMiddleware',

    'django.middleware.security.SecurityMiddleware',

]



ROOT_URLCONF = '{{ project_name }}.urls'

docs/ref/middleware.txt

+6 −0
Original line number Diff line number Diff line
@@ -411,6 +411,12 @@ Middleware ordering 


Here are some hints about the ordering of various Django middleware classes:



#. :class:`~django.middleware.security.SecurityMiddleware`



   It should go near the top of the list if you're going to turn on the SSL

   redirect as that avoids running through a bunch of other unnecessary

   middleware.



#. :class:`~django.middleware.cache.UpdateCacheMiddleware`



   Before those that modify the ``Vary`` header (``SessionMiddleware``,

docs/topics/http/middleware.txt

+1 −1
Original line number Diff line number Diff line
@@ -28,6 +28,7 @@ here's the default value created by :djadmin:`django-admin startproject 
<startproject>`::



    MIDDLEWARE_CLASSES = [

        'django.middleware.security.SecurityMiddleware',

        'django.contrib.sessions.middleware.SessionMiddleware',

        'django.middleware.common.CommonMiddleware',

        'django.middleware.csrf.CsrfViewMiddleware',
@@ -35,7 +36,6 @@ here's the default value created by :djadmin:`django-admin startproject 
        'django.contrib.auth.middleware.SessionAuthenticationMiddleware',

        'django.contrib.messages.middleware.MessageMiddleware',

        'django.middleware.clickjacking.XFrameOptionsMiddleware',

        'django.middleware.security.SecurityMiddleware',

    ]



A Django installation doesn't require any middleware —