Django community: RSS
This page, updated regularly, aggregates Django Software Foundation from the Django community.
-
See You in Chicago in One Month!
In just one month, developers, maintainers, educators, and Django enthusiasts from around the world will gather in Chicago for DjangoCon US 2026. DjangoCon US is more than a conference, it's a place to learn from the community, share ideas, contribute to Django, and make connections that last long after the event ends. Whether you're attending your first DjangoCon US or you've been coming for years, we're excited to welcome you. Over five days, attendees will have the opportunity to: Learn from expert speakers and community members Participate in hands-on tutorials Collaborate during Django sprints Join Open Spaces and informal discussions Meet fellow Django developers from across the globe If you're planning to join us, tickets are still available, and there's still time to reserve your stay at the conference hotel. The hotel room block deadline is August 3, so be sure to book your room before then. Register today! August 24–28, 2026 Chicago, Illinois We can't wait to see you in Chicago! -
Django 6.1 release candidate 1 released
Django 6.1 release candidate 1 is now available. It represents the final opportunity for you to try out the version that offers a harmonious mélange of new features and usability improvements, before Django 6.1 final is released. The release candidate stage marks the string freeze and the call for translators to submit translations. Provided no major bugs are discovered that can't be solved in the next two weeks, Django 6.1 will be released on or around August 5. Any delays will be communicated on the Django forum. Please use this opportunity to help find and fix bugs (which should be reported to the issue tracker), you can grab a copy of the release candidate package from our downloads page or on PyPI. The PGP key ID used for this release is Jacob Walls: 131403F4D16D8DC7 -
Supporting the Triptych Project
The Django Steering Council — in its role as the DSF's arm for technical governance — has provided a Letter of Collaboration in support of a funding application by Carson Gross and Alex Petros to advance the Triptych Project: three proposals to make HTML itself more expressive, in every browser, by default. Here's why, and how you can help. HTML over the wire, and Django The last few years have seen a move back towards serving multipage applications, with server-rendered templates. The HTMX library has probably had the biggest impact in the Django space, but Unpoly, Turbo, and others are part of the same story: send HTML over the wire, let the browser do what browsers do, and skip the client-side application layer where you don't really need it. It's a simpler model of the web — and it's one that speaks to Django's heart. This isn't a movement Django has watched from the sidelines. Template partials, added in Django 6.0, were directly inspired by the patterns these libraries make natural. The Triptych Project The Triptych Project takes the core insights from HTMX (and the related libraries) and proposes them for the HTML standard itself. Three small additions: PUT, PATCH, … -
Explore the DjangoCon US 2026 Speaker Lineup and Reserve Your Spot
DjangoCon US 2026 is just around the corner, and now is the perfect time to start planning your conference experience. Our speaker lineup is now available, featuring talks from Django contributors, maintainers, educators, and community members covering everything from web development and APIs to deployment, security, testing, AI, and the future of the Django ecosystem. Whether you're attending your first DjangoCon US or returning to reconnect with friends and colleagues, you'll find opportunities to learn, share ideas, and meet people from across the global Django community. Beyond the talks, your conference registration includes access to tutorials, Open Spaces, community sprints, hallway conversations, and social events that make DjangoCon US a unique experience. If you haven't registered yet, there's still time to join us in Chicago, August 24–28. Register for DjangoCon US 2026: https://2026.djangocon.us Browse the speaker lineup: https://2026.djangocon.us/news/announcing-lineup/ We'll be sharing more updates in the coming weeks, including the full conference schedule, travel reminders, and everything you need to make the most of your time at DjangoCon US. We look forward to seeing you in Chicago this August! -
Last Call 2026 Django Developer Survey
Time is running out. This is the last call for the 2026 Django Developers Survey, which the Django Software Foundation is running in partnership with JetBrains. The survey closes on July 13, 2026. It is one of the best measures we have of how Django is used, and it helps guide future technical and community decisions. So far, over 3,100 people have responded, and we would love to push that number past 4,000. Every response helps us better understand the Django community. This year's survey was shaped by the Django Steering Council, the Django Fellows, the Django Software Foundation Board of Directors, and several community members. Your feedback helps us understand your needs, see how you use Django, and plan for future development and community needs. How you can help Once you’ve done the survey, take a moment to re-share on socials and with your communities. The more diverse the answers, the better the results for all of us. We appreciate everybody helping to get the word out. Please use the following links: Bluesky https://surveys.jetbrains.com/s3/bs-django-developers-survey-2026 Django Forum https://surveys.jetbrains.com/s3/df-django-developers-survey-2026 LinkedIn https://surveys.jetbrains.com/s3/li-django-developers-survey-2026 Mastodon https://surveys.jetbrains.com/s3/md-django-developers-survey-2026 Reddit https://surveys.jetbrains.com/s3/r-django-developers-survey-2026 X / Twitter https://surveys.jetbrains.com/s3/x-django-developers-survey-2026 For more details, read the original announcement on the Django blog. -
Django security releases issued: 6.0.7 and 5.2.16
In accordance with our security release policy, the Django team is issuing releases for Django 6.0.7 and Django 5.2.16. These releases address the security issues detailed below. We encourage all users of Django to upgrade as soon as possible. CVE-2026-48588: Potential exposure of private data via cached Set-Cookie response django.middleware.cache.UpdateCacheMiddleware and django.views.decorators.cache.cache_page avoided caching responses that set a cookie while varying on Cookie only when the incoming request contained no cookies at all. When the request already carried an unrelated cookie (such as a language or theme preference cookie), the protection did not apply, allowing a response that sets a session or other sensitive cookie to be stored in Django's shared cache. This issue has severity "low" according to the Django security policy. Thanks to Chris Whyland for the report. CVE-2026-53877: Heap buffer over-read in GDALRaster When django.contrib.gis.gdal.GDALRaster was instantiated with a bytes object representing a raster file, the vsi_buffer property could over-read the allocated buffer by approximately 32 bytes. This could result in information disclosure of adjacent heap memory or, in rare cases, a segmentation fault. Only rasters stored in GDAL's virtual filesystem were affected. This issue has severity "low" according to the Django security policy. Thanks to Bence … -
Keeping Up with the Django Community
The Django community runs on volunteer effort spread across several different groups of people. Most of it is public, but it isn't always easy to find. Here are the public places to find it: Weekly DSF Office Hours (website) DSF Board updates (website, GitHub repo) Steering Council (forum thread, GitHub repo) Website Working Group (forum thread) Online Community Working Group (forum thread) Django Fellow Reports (Jacob, Natalia, Sarah) DSF Office Hours Most of these are places to read and follow along, but one invites you to show up in real time, the DSF Office Hours. From the website: These are weekly office hours to work on anything related to the DSF. At least one board member will try to attend each week. Office hours take place every Wednesday at 6:00 PM UTC. All you need to do is bring something DSF-related to work on. This is intentionally broad, as long as it's vaguely DSF-related you're welcome to come. It's not a general-purpose Django coding session (you're welcome to be writing code but it should be related the DSF, e.g. working on djangoproject.com or something). They are friendly and casual. People are welcome to bring topics and discussions for everyone to … -
DSF member of the month - Salim Nuru
For June 2026, we welcome Salim Nuru as our DSF member of the month! ⭐ Salim was a Djangonaut Space participant in the first session. He has been an organiser of the DjangoCon Africa conference. He is currently the chair of the DjangoCon US website. He a DSF member since October 2024. He is looking for new opportunities! You can learn more about Salim by visiting Salim's blog and his GitHub Profile. Let’s spend some time getting to know Salim better! Can you tell us a little about yourself (hobbies, education, etc)? I'm Salim, I’m from Addis, Ababa Ethiopia. I'm a software engineer by day and a security researcher by night. And for fun, I like chess, video games, and books. I already have an idea, but where does your nickname "theShinigami" come from? I LOVE anime, and the very first anime I watched was Death Note. There's this character called Ryuk, who is a "shinigami," and when I created my GitHub account, it was a time when I was really into anime (which I still am). That's why it stuck as my GitHub username. How did you start using Django? I started using Django during my college years. I … -
How the Django Software Foundation Became a CNA
Why the DSF pursued CNA status Django has a long history of responsible security practices: a dedicated, private security mailing list, clear advisory policies, and predictable security releases. Even so, we relied on external organizations to assign CVE IDs (Common Vulnerabilities and Exposures). This sometimes introduced administrative delays and extra coordination overhead. Becoming a CNA (CVE Numbering Authority) allows the DSF to: Assign CVEs ourselves for vulnerabilities in Django and selected community projects. Publish advisories more efficiently and in closer alignment with Django's established release workflow. Maintain strong independence in how Django handles security incidents. The initial exploration The process began with internal discussions within the DSF Board and Django Security Team. We evaluated: Whether our existing security process already met CNA expectations. Whether we had the organizational stability to take on long term responsibility for CVE assignment. The scope of projects we would cover. How to ensure we could meet the operational requirements without overloading volunteers and Django Fellows. After confirming that our policies were mature and that the administrative workload would be manageable, we initiated the CNA application with MITRE. Preparing the application MITRE requires that new CNAs document their security processes and demonstrate that they can meet … -
Django 6.1 beta 1 released
Django 6.1 beta 1 is now available. It represents the second stage in the 6.1 release cycle and is an opportunity to try out the changes coming in Django 6.1. Django 6.1 offers a harmonious mélange of new features and usability improvements, which you can read about in the in-development 6.1 release notes. Only bugs in new features and regressions from earlier Django versions will be fixed between now and the 6.1 final release. Translations will be updated following the "string freeze", which occurs when the release candidate is issued. The current release schedule calls for a release candidate in about a month, with the final release scheduled roughly two weeks later on August 5. Early and frequent testing from the community will help minimize the number of bugs in the release. Updates on the release schedule are available on the Django forum. As with all alpha and beta packages, this release is not for production use. However, if you'd like to try some of the new features or help find and fix bugs (which should be reported to the issue tracker), you can grab a copy of the beta package from our downloads page or on PyPI. The PGP … -
Announcing the Search for a DSF Executive Director
The Django Software Foundation is hiring its first Executive Director, and we have the Django community to thank for making it possible. Six Django web development agencies have jointly pledged $47,500 to help fund the Executive Director's first year: Caktus Group, Lincoln Loop, Six Feet Up, Cuttlesoft, OddBird, and Two Rock. This is the financial foundation we needed to move from "we should hire an ED someday" to "we are hiring an ED now." Why This Role Matters The DSF has grown significantly over the past several years. We fund multiple Django Fellows, distribute grants to events around the world, manage corporate and individual memberships, oversee working groups, and handle the legal and operational responsibilities of a 501(c)(3) nonprofit. For years, volunteer board members have carried this operational load alongside their regular jobs. That dedication has carried us far, but there are real limits to what a volunteer board can do. An Executive Director changes that. This person would handle day-to-day operations and administration, sponsorship development and partner relationships, community outreach and communications, coordination with the Django Fellows and working groups, and grant management and financial reporting. It is a paid position, part-time or full-time depending on the candidate, for … -
DSF 2026 Fundraising Goals
Django has grown far beyond a web framework. It powers businesses, nonprofits, startups, educational institutions, and critical infrastructure around the world. The Django Software Foundation exists to support that ecosystem, and none of that work is possible without funding. This year, the board set an ambitious new fundraising goal, and I want to be transparent about what we are aiming for and why it matters. Before talking about where we want to go, it's important to recognize that everything the DSF does today is possible because of the organizations and individuals who already support Django. Their contributions fund the work that keeps Django healthy, secure, and sustainable, and we are deeply grateful for that support. Our 2026 Goal: $500,000 This year, we are raising our annual fundraising goal from $300,000 to $500,000. That is a meaningful increase, and it reflects where the foundation needs to be. Our current monthly recurring donations are around $9,000 per month. To reach $500,000 annually, we need to grow that to approximately $15,000 per month. Reaching this goal will require both new supporters and increased support from existing donors. Doing so will help us maintain the programs the community relies on while creating room for … -
Django security releases issued: 6.0.6 and 5.2.15
In accordance with our security release policy, the Django team is issuing releases for Django 6.0.6 and Django 5.2.15. These releases address the security issues detailed below. We encourage all users of Django to upgrade as soon as possible. CVE-2026-6873: Signed cookie salt namespace collision in django.http.HttpRequest.get_signed_cookie get_signed_cookie() derived the signing salt by concatenating the cookie name (key) and salt arguments. When distinct name and salt pairs produced the same concatenation, cookies could be accepted in a context different from the one where they were signed. Cookies are now signed with an unambiguous salt derivation. For backwards compatibility, cookies signed by older Django versions are accepted until Django 7.0. This issue has severity "low" according to the Django security policy. Thanks to Peng Zhou for the report. CVE-2026-7666: Potential unencrypted email transmission via STARTTLS in the SMTP backend When using EMAIL_USE_TLS, a failed STARTTLS handshake could leave a partially-initialized connection that would subsequently be reused for sending email without encryption. This can occur with fail_silently=True, as used by send_mail() and BrokenLinkEmailsMiddleware, among others. Connections configured with EMAIL_USE_SSL are not affected. This issue has severity "low" according to the Django security policy. Thanks to Kasper Dupont for the report. CVE-2026-8404: Potential … -
Django 6.1 alpha 1 released
Django 6.1 alpha 1 is now available. It represents the first stage in the 6.1 release cycle and is an opportunity to try out the changes coming in Django 6.1. Django 6.1 offers a harmonious mélange of new features and usability improvements, which you can read about in the in-development 6.1 release notes. This alpha milestone marks the feature freeze. The current release schedule calls for a beta release in about a month and a release candidate roughly a month after that. We'll only be able to keep this schedule with early and frequent testing from the community. Updates on the release schedule are available on the Django forum. As with all alpha and beta packages, this release is not for production use. However, if you'd like to take some of the new features for a spin, or help find and fix bugs (which should be reported to the issue tracker), you can grab a copy of the alpha package from our downloads page or on PyPI. The PGP key ID used for this release is Jacob Walls: 131403F4D16D8DC7 -
2026 Django Developers Survey
The Django Software Foundation is once again partnering with JetBrains to run the 2026 Django Developers Survey 🌈 It’s an important metric of Django usage and is immensely helpful to guide future technical and community decisions. After the survey closes, we will publish the aggregated results. JetBrains will also randomly select 10 winners (from those who complete the survey in full with meaningful answers) who will each receive a $100 Amazon voucher or the equivalent in local currency. Summary Help shape the future of Django by taking the 2026 Django Developers Survey and sharing it with your communities so we can better understand how Django is being used around the world. How you can help Once you’ve done the survey, take a moment to re-share on socials and with your communities. The more diverse the answers, the better the results for all of us. Please use the following links: Bluesky https://surveys.jetbrains.com/s3/bs-django-developers-survey-2026 Django Forum https://surveys.jetbrains.com/s3/df-django-developers-survey-2026 LinkedIn https://surveys.jetbrains.com/s3/li-django-developers-survey-2026 Mastodon https://surveys.jetbrains.com/s3/md-django-developers-survey-2026 Reddit https://surveys.jetbrains.com/s3/r-django-developers-survey-2026 X / Twitter https://surveys.jetbrains.com/s3/x-django-developers-survey-2026 -
DSF member of the month - Bhuvnesh Sharma
For May 2026, we welcome Bhuvnesh Sharma as our DSF member of the month! ⭐ Bhuvnesh is a Django contributor since 2022 and a Google Summer of Code (GSoC) participant in 2023 for Django. He is now a mentor and an admin organizer for GSoC for the Django organization. He is the founder of Django Events Foundation India (DEFI) and DjangoDay India conference. He has been a DSF member since July 2023. He is looking for new opportunities! You can learn more about Bhuvnesh by visiting Bhuvnesh's website and his GitHub Profile. Let’s spend some time getting to know Bhuvnesh better! Can you tell us a little about yourself (hobbies, education, etc) I’m Bhuvnesh (aka DevilsAutumn), a software developer from India. I graduated in 2024 from GL Bajaj Institute of technology and management, and most of my work has been around Python, Django and building backend systems. My journey with Django started when I started contributing to Django core in 2022. I usually like working on things where there is an actual product involved, not just writing few APIs and closing the task. I like thinking about how the whole thing will work: models, permissions, background jobs, deployment, users, edge … -
Announcing the Google Summer of Code 2026 contributors for Django
The Django Software Foundation is happy to share the contributors selected for Google Summer of Code 2026. This year, we received over 200 proposals from contributors across the world. The level of detail and thought in these proposals made the selection process both exciting and challenging. Accepted Projects We’re pleased to announce the following projects: Implementing an experimental API framework for Django core Contributor: Praful Gulani Mentor: Andrew Miller This project explores an approach to introducing experimental APIs in Django by modernizing DEP 2 and defining an opt-in model. Add support for table-valued expressions in the ORM Contributor: p-r-a-v-i-n Mentors: Bhuvnesh Sharma, Jacob Walls This project develops a way to join against table-valued expressions such as Subquery() or PostgreSQL functions like generate_series() within the ORM. Unified dark mode and UI consistency for Django’s issue tracker Contributor: Keha Chandrakar Mentors: Saptak S, Sarah A This project adds dark mode support to Django’s issue tracker and brings it closer in visual consistency to the main Django website. Switch to Playwright tests for integration testing Contributor: Varun Kasyap Pentamaraju Mentor: Sarah Boyce This project focuses on improving Django’s browser integration testing by transitioning from Selenium to Playwright. Each of these projects focuses on … -
Django security releases issued: 6.0.5 and 5.2.14
In accordance with our security release policy, the Django team is issuing releases for Django 6.0.5 and Django 5.2.14. These releases address the security issues detailed below. We encourage all users of Django to upgrade as soon as possible. CVE-2026-5766: Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass ASGI requests with a missing or understated Content-Length header could bypass the FILE_UPLOAD_MAX_MEMORY_SIZE limit, potentially loading large files into memory and causing service degradation. As a reminder, Django expects a limit to be configured at the web server level rather than solely relying on FILE_UPLOAD_MAX_MEMORY_SIZE. This issue has severity "low" according to the Django security policy. This issue was originally highlighted by Kyle Agronick in Trac. Thanks to Jacob Walls for following up and reporting it. CVE-2026-35192: Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST Response headers did not vary on cookies if a session was not modified, but SESSION_SAVE_EVERY_REQUEST was True. A remote attacker could steal a user's session after that user visits a cached public page. This issue has severity "low" according to the Django security policy. CVE-2026-6907: Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware Previously, django.middleware.cache.UpdateCacheMiddleware would erroneously cache … -
Renew Your PyCharm License and Support Django
Only a few days remain to support the Django Software Foundation through our annual JetBrains fundraiser. You can now use the offer for new purchases and annual renewals. If your PyCharm Professional subscription expires this year, this is a great time to renew or extend it for up to 12 months. Get 30% off PyCharm Professional, and 100% of proceeds from qualifying purchases and renewals go to the DSF to help fund Django Fellows, community programs, events, and the future of Django. 👉 Offer ends May 1: Learn more about the fundraiser 👉 Claim 30% off here: Get the JetBrains offer -
It's time to redesign djangoproject.com
If you've felt like djangoproject.com could use a refresh, you're not alone. The site has served the community well for a long time, it’s beloved by a lot of people but doesn’t reflect where Django is today or who we want to reach. We've been working on a redesign behind the scenes, and we want to share where we're headed and how you can get involved. Why a redesign The case has been building for a while. The excellent user research report from 20tab documented in detail what current site users struggle with, and the more recent community discussion on homepage redesigns on the forum focuses on the image issue. In her recent talk Debunking Django Myths, Sarah Boyce, one of our Django Fellows who helps maintain the project, walked through the gap between how Django is perceived and what it actually offers in 2026. Our website is one of the places where the gap is widest, and we need to close it. Debunking Django Myths - Sarah Boyce @ Python Unplugged on PyTV It’s harder than it looks on the surface, as it’s essential the site serves both as a showcase of the value of Django for newcomers; and … -
DSF member of the month - Rob Hudson
For April 2026, we welcome Rob Hudson as our DSF member of the month! ⭐ Rob is the creator of django-debug-toolbar (DDT), tool used by more than 100 000 folks in the world. He introduces Content-Security-Policy (CSP) support in Django and contribute to many open source packages. He has been a DSF member since February 2024. You can learn more about Rob by visiting Rob's website and his GitHub Profile. Let’s spend some time getting to know Rob better! Can you tell us a little about yourself I'm a backend Python engineer based in Oregon, USA. I studied biochemistry in college, where software was just a curiosity and hobby on the side, but I'm grateful that my curiosity turned into a career in tech. My earliest memory of that curiosity was taking apart my Speak & Spell as a kid to see how it worked and never quite getting it back together again. How did you start using Django? I followed the path of the "P"s: Perl, then PHP, then Python. When Ruby on Rails arrived it was getting a lot of attention, but I was already enjoying Python, so when Django was announced I was immediately drawn to it. … -
New Technical Governance - request for community feedback
Hello Django community, The Steering Council is excited to share our proposed new technical governance and ask for your feedback. Last year we suspended the formal voting process of the Steering Council. The updates we’re proposing would bring how we’ve been operating into alignment with the written governance. From the motivation section: This is a revisitation of Django's technical governance in which a simplification and reduction was made to make it more approachable to more people. The goals of these changes are the following: Make it easier to enact our governance. Make it easier for others to understand our governance. Make the governance more flexible, allowing more action with less procedure. You can read DEP 0019 here. Adoption plan The goal is to have this governance accepted and in place by 2026-07-01. Our timeline is as follows, but may change depending on feedback. 2026-04-16: Announce new technical governance, solicit feedback 2026-05-07: Merge in minor feedback changes 2026-05-28: Resolve major feedback concerns 2026-06-11: Steering Council and DSF Board vote on and approve DEP What we need from you We would like to know if we are achieving our goals with this document. For example, do you feel that this makes our … -
PyCharm & Django annual fundraiser
For another year, we are thrilled to partner with our friends at JetBrains on the annual "Buy PyCharm, Support Django" campaign. This is the first of two fundraisers we're running with JetBrains this year, and it's one of the most impactful ways the community can support the Django Software Foundation. "JetBrains is a cornerstone in the Django community, consistently helping us understand our evolving landscape. Their annual survey provides invaluable insights into the community's needs, trends, and tools, ensuring we stay on the pulse of what matters most." Jeff Triplett, President, Django Software Foundation Your support of this campaign helps fund key initiatives such as: Django Fellows: Ensuring the rapid development and maintenance of Django. Djangonaut Space: Onboarding new contributors to the Django project. Django Girls: Making the Django community accessible to programming beginners around the world. International events and conferences: Supporting DjangoCons, one-day events, meetups, and other community gatherings around the world. How the campaign works From today to May 1, when you purchase PyCharm at a 30% discount through our special campaign link, JetBrains will donate an equal amount to the Django Software Foundation. You get a professional IDE that's trusted by Django developers worldwide, and the DSF … -
Django Has Adopted Contributor Covenant 3
We’re excited to announce that Django has officially adopted Contributor Covenant 3 as our new Code of Conduct! This milestone represents the completion of a careful, community-driven process that began earlier this year. What We’ve Accomplished Back in February, we announced our plan to adopt Contributor Covenant 3 through a transparent, multi-step process. Today, we’re proud to share that we’ve completed all three steps: Step 1 (Completed February 2026): Established a community-driven process for proposing and reviewing changes to our Code of Conduct. Step 2 (Completed March 2026): Updated our Enforcement Manual, Reporting Guidelines, and FAQs to align with Contributor Covenant 3 and incorporate lessons learned from our working group’s experience. Step 3 (Completed April 2026): Adopted the Contributor Covenant 3 with Django-specific enhancements. Why Contributor Covenant 3? Contributor Covenant 3 represents a significant evolution in community standards, incorporating years of experience from communities around the world. The new version: Centers impact over intent, recognizing that even unintentional harm requires accountability and repair Emphasizes consent and boundaries, making explicit that community members must respect stated boundaries immediately Addresses modern harassment patterns like sea-lioning, coordinated harassment, and microaggressions Includes clearer guidance on enforcement, transparency, and accountability By adopting this widely-used standard, … -
Django security releases issued: 6.0.4, 5.2.13, and 4.2.30
In accordance with our security release policy, the Django team is issuing releases for Django 6.0.4, Django 5.2.13, and Django 4.2.30. These releases address the security issues detailed below. We encourage all users of Django to upgrade as soon as possible. Django 4.2 has reached the end of extended support Note that with this release, Django 4.2 has reached the end of extended support. All Django 4.2 users are encouraged to upgrade to Django 5.2 or later to continue receiving fixes for security issues. See the downloads page for a table of supported versions and the future release schedule. CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation ASGIRequest normalizes header names following WSGI conventions, mapping hyphens to underscores. As a result, even in configurations where reverse proxies carefully strip security-sensitive headers named with hyphens, such a header could be spoofed by supplying a header named with underscores. Under WSGI, it is the responsibility of the server or proxy to avoid ambiguous mappings. (Django's runserver was patched in CVE-2015-0219.) But under ASGI, there is not the same uniform expectation, even if many proxies protect against this under default configuration (including nginx via underscores_in_headers off;). Headers containing underscores are now ignored by ASGIRequest, …
