mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-31 09:41:08 +00:00
Code Issues 32 Releases Wiki Activity

[1.6.x] Fixed #22504 -- Corrected domain terminology in security guide.

Browse Source 
Thanks chris at chrullrich.net.

Backport of f65eb15ac6 from master
This commit is contained in:
Tim Graham
2014-04-25 10:27:13 -04:00
parent 2b0e9aa57d
commit e9c78435ab
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
docs/topics/security.txt
View File

@@ -237,11 +237,11 @@ User-uploaded content
you can take to mitigate these attacks:
1. One class of attacks can be prevented by always serving user uploaded
content from a distinct Top Level Domain (TLD). This prevents any
exploit blocked by `same-origin policy`_ protections such as cross site
scripting. For example, if your site runs on ``example.com``, you would
want to serve uploaded content (the :setting:`MEDIA_URL` setting) from
something like ``usercontent-example.com``. It's *not* sufficient to
content from a distinct top-level or second-level domain. This prevents
any exploit blocked by `same-origin policy`_ protections such as cross
site scripting. For example, if your site runs on ``example.com``, you
would want to serve uploaded content (the :setting:`MEDIA_URL` setting)
from something like ``usercontent-example.com``. It's *not* sufficient to
serve content from a subdomain like ``usercontent.example.com``.
2. Beyond this, applications may choose to define a whitelist of allowable