Upgrading django-cors-headers 2 to 3
Breaking2.5.3 → 3.14.0Breaking3Platform7Deprecated1Changed10Fixed4Other3
BreakingUpgrade verdict
3 breaking changes and 7 platform requirement changes.
In plain terms
- The package no longer has a __version__ value you can read directly; use Python's standard metadata tools to look up the installed version instead.
- The CORS_MODEL setting and its class are gone. If you relied on them, stop inheriting from the abstract model and add a check_request_enabled signal handler that reads from your own model, handling scheme-prefixed Origins.
- The list of allowed website origins must now include the scheme like https://, not just the domain. This closes a hole where an insecure http:// site could make requests to a secure https:// site.
- The package can now be used with Python 3.11.
Must act Top 5 of 11 that need code or config changes
Python requirement changed in 3.11.0: >=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.* → >=3.7.
What you must change
Breaking3
Removes the package's __version__ attribute after converting setuptools metadata to a configuration file.
__version__importlib.metadata.version()Removes the CORS_MODEL setting and its associated class.
CORS_MODELcheck_request_enabledCORS_ORIGIN_WHITELIST now requires URI schemes and optionally ports, fixing a security issue where requests were allowed between schemes.
CORS_ORIGIN_WHITELISTCORS_ORIGIN_REGEX_WHITELISTPlatform7
Adds support for Python 3.11.
Drops support for Python 3.6.
Adds support for Python 3.10.
Drops Python 3.5 support.
Adds support for Python 3.9.
Adds support for Python 3.8.
Drops Python 2 support; only Python 3.5-3.7 is supported now.
Deprecations to plan for
Deprecated1
Renames CORS_ORIGIN_WHITELIST, CORS_ORIGIN_REGEX_WHITELIST and CORS_ORIGIN_ALLOW_ALL to CORS_ALLOWED_ORIGINS, CORS_ALLOWED_ORIGIN_REGEXES and CORS_ALLOW_ALL_ORIGINS.
CORS_ORIGIN_WHITELISTCORS_ALLOWED_ORIGINSCORS_ORIGIN_REGEX_WHITELISTCORS_ALLOWED_ORIGIN_REGEXESCORS_ORIGIN_ALLOW_ALLCORS_ALLOW_ALL_ORIGINSAPI changes
Generated by DepDelta from published Python source. Not mixed with prose notes.
- removed:
export check_settings
- added:
class CorsHeadersAppConfig(AppConfig) - added:
field CorsHeadersAppConfig.name - added:
field CorsHeadersAppConfig.verbose_name - added:
method CorsHeadersAppConfig.ready() -> None
- changed:
function check_settings(app_configs, **kwargs) → function check_settings(**kwargs: Any) -> list[CheckMessage] - changed:
function is_sequence(thing, types) → function is_sequence(thing: Any, type_or_types: type[Any] | tuple[type[Any], ...]) -> bool
- removed:
property Settings.CORS_ALLOW_CREDENTIALS - removed:
property Settings.CORS_ALLOW_HEADERS - removed:
property Settings.CORS_ALLOW_METHODS - removed:
property Settings.CORS_EXPOSE_HEADERS - removed:
property Settings.CORS_MODEL - removed:
property Settings.CORS_ORIGIN_ALLOW_ALL - removed:
property Settings.CORS_ORIGIN_REGEX_WHITELIST - removed:
property Settings.CORS_ORIGIN_WHITELIST - removed:
property Settings.CORS_PREFLIGHT_MAX_AGE - removed:
property Settings.CORS_REPLACE_HTTPS_REFERER - removed:
property Settings.CORS_URLS_REGEX - changed:
class Settings(object) → class Settings - added:
property Settings.CORS_ALLOWED_ORIGINS -> list[str] | tuple[str] - added:
property Settings.CORS_ALLOWED_ORIGIN_REGEXES -> Sequence[str | Pattern[str]] - added:
property Settings.CORS_ALLOW_ALL_ORIGINS -> bool - added:
property Settings.CORS_ALLOW_CREDENTIALS -> bool - added:
property Settings.CORS_ALLOW_HEADERS -> Sequence[str] - added:
property Settings.CORS_ALLOW_METHODS -> Sequence[str] - added:
property Settings.CORS_EXPOSE_HEADERS -> Sequence[str] - added:
property Settings.CORS_PREFLIGHT_MAX_AGE -> int - added:
property Settings.CORS_REPLACE_HTTPS_REFERER -> bool - added:
property Settings.CORS_URLS_REGEX -> str | Pattern[str]
- removed:
method CorsMiddleware.origin_found_in_model(url) - changed:
method CorsMiddleware.check_signal(request) → method CorsMiddleware.check_signal(request: HttpRequest) -> bool - changed:
method CorsMiddleware.is_enabled(request) → method CorsMiddleware.is_enabled(request: HttpRequest) -> bool - changed:
method CorsMiddleware.origin_found_in_white_lists(origin, url) → method CorsMiddleware.origin_found_in_white_lists(origin: str, url: SplitResult) -> bool - changed:
method CorsMiddleware.process_request(request) → method CorsMiddleware.process_request(request: HttpRequest) -> HttpResponse | None - changed:
method CorsMiddleware.process_response(request, response) → method CorsMiddleware.process_response(request: HttpRequest, response: HttpResponse) -> HttpResponse - changed:
method CorsMiddleware.process_view(request, callback, callback_args, callback_kwargs) → method CorsMiddleware.process_view(request: HttpRequest, callback: Any, callback_args: Any, callback_kwargs: Any) -> None - changed:
method CorsMiddleware.regex_domain_match(origin) → method CorsMiddleware.regex_domain_match(origin: str) -> bool - changed:
method CorsPostCsrfMiddleware.process_request(request) → method CorsPostCsrfMiddleware.process_request(request: HttpRequest) -> None - changed:
method CorsPostCsrfMiddleware.process_view(request, callback, callback_args, callback_kwargs) → method CorsPostCsrfMiddleware.process_view(request: HttpRequest, callback: Any, callback_args: Any, callback_kwargs: Any) -> None
- removed:
class AbstractCorsModel(models.Model) - removed:
class AbstractCorsModel.Meta - removed:
field AbstractCorsModel.Meta.abstract - removed:
field AbstractCorsModel.Meta.db_table - removed:
field AbstractCorsModel.cors