mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-07-31 00:54:37 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

BACKWARDS-INCOMPATIBLE CHANGE: Removed SetRemoteAddrFromForwardedFor middleware.

Browse source 
In a nutshell, it's been demonstrated that this middleware can never be made reliable enough for general-purpose use, and that (despite documentation to the contrary) its inclusion in Django may lead application developers to assume that the value of ``REMOTE_ADDR`` is "safe" or in some way reliable as a source of authentication. So it's gone.

See the Django 1.1 release notes for full details, as well as upgrade instructions.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@11363 bcc190cf-cafb-0310-a4f2-bffc1f526a37
This commit is contained in:
Jacob Kaplan-Moss 2009-07-29 05:35:51 +00:00
parent 91f18400cc
commit d78cf61c99
2 changed files with 19 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

13
docs/ref/middleware.txt
View file

@ -122,17 +122,10 @@ Reverse proxy middleware
.. class:: django.middleware.http.SetRemoteAddrFromForwardedFor
Sets ``request.META['REMOTE_ADDR']`` based on
``request.META['HTTP_X_FORWARDED_FOR']``, if the latter is set. This is useful
if you're sitting behind a reverse proxy that causes each request's
``REMOTE_ADDR`` to be set to ``127.0.0.1``.
.. versionchanged: 1.1
**Important note:** This does NOT validate ``HTTP_X_FORWARDED_FOR``. If you're
not behind a reverse proxy that sets ``HTTP_X_FORWARDED_FOR`` automatically, do
not use this middleware. Anybody can spoof the value of
``HTTP_X_FORWARDED_FOR``, and because this sets ``REMOTE_ADDR`` based on
``HTTP_X_FORWARDED_FOR``, that means anybody can "fake" their IP address. Only
use this when you can absolutely trust the value of ``HTTP_X_FORWARDED_FOR``.
This middleware was removed in Django 1.1. See :ref:`the release notes
<removed-setremoteaddrfromforwardedfor-middleware>` for details.
Locale middleware
-----------------