mirror of
https://github.com/django/django.git
synced 2024-12-24 01:55:49 +00:00
Fixed #22504 -- Corrected domain terminology in security guide.
Thanks chris at chrullrich.net.
This commit is contained in:
parent
deb561bbe2
commit
f65eb15ac6
@ -237,11 +237,11 @@ User-uploaded content
|
||||
you can take to mitigate these attacks:
|
||||
|
||||
1. One class of attacks can be prevented by always serving user uploaded
|
||||
content from a distinct Top Level Domain (TLD). This prevents any
|
||||
exploit blocked by `same-origin policy`_ protections such as cross site
|
||||
scripting. For example, if your site runs on ``example.com``, you would
|
||||
want to serve uploaded content (the :setting:`MEDIA_URL` setting) from
|
||||
something like ``usercontent-example.com``. It's *not* sufficient to
|
||||
content from a distinct top-level or second-level domain. This prevents
|
||||
any exploit blocked by `same-origin policy`_ protections such as cross
|
||||
site scripting. For example, if your site runs on ``example.com``, you
|
||||
would want to serve uploaded content (the :setting:`MEDIA_URL` setting)
|
||||
from something like ``usercontent-example.com``. It's *not* sufficient to
|
||||
serve content from a subdomain like ``usercontent.example.com``.
|
||||
|
||||
2. Beyond this, applications may choose to define a whitelist of allowable
|
||||
|
Loading…
Reference in New Issue
Block a user