Re: django-admin startproject settings.py has some security holes

There is such a link since 2013: https://github.com/django/django/commit/912b5d2a6bc78067d6a7e130f10514c51bd1a58f On Thu, 24 Oct 2019 at 23:31, Olivier Dalang wrote: > Hi, > > Just a reminder about this page in the docs: > https://docs.djangoproject.com/en/2.2/howto/deployment/checklist/ > It ba

Deprecate HttpRequest.is_ajax

Django's HttpRequest.is_ajax method determines whether the request was made with the JS API XMLHttpRequest https://docs.djangoproject.com/en/2.2/ref/request-response/#django.http.HttpRequest.is_ajax . It does so by checking the X-Requested-With header. The new way of making "AJAX" requests from th

Re: Deprecate HttpRequest.is_ajax

I would agree. Flask has done the same: DeprecationWarning: Request.is_xhr is deprecated. Given that the X-Requested-With header is not a part of any spec, it is not reliable In my opinion there are not many good reasons to have to change behaviour if a request is made via XHR. I think the most