Upgrading django-cors-headers 3 to 4
Breaking3.14.0 → 4.9.0Breaking2Platform5New2Changed5Fixed2
BreakingUpgrade verdict
2 breaking changes and 5 platform requirement changes.
In plain terms
- Three headers are no longer allowed by default, but this has no practical effect because browsers never let JavaScript set them anyway.
- An old workaround for CSRF checks is gone; use Django's CSRF_TRUSTED_ORIGINS setting instead.
- The package can now be used with Python 3.14.
- This version no longer works on Python 3.8, so you need a newer Python to install it.
Must act Top 5 of 7 that need code or config changes
Python requirement changed in 4.5.0: >=3.7 → >=3.9.
Adds asgiref >=3.6.
What you must change
Breaking2
Removes accept-encoding, dnt, and origin from the default accept list since they are forbidden header names JavaScript cannot set.
accept-encodingdntoriginDrops the CORS_REPLACE_HTTPS_REFERER setting and CorsPostCsrfMiddleware, superseded by Django's CSRF_TRUSTED_ORIGINS since Django 1.9.
CORS_REPLACE_HTTPS_REFERERCorsPostCsrfMiddlewareCSRF_TRUSTED_ORIGINSPlatform5
Adds support for Python 3.14.
Drops Python 3.8 support.
Adds support for Python 3.13.
Drops support for Python 3.7.
Adds support for Python 3.12.
API changes
Generated by DepDelta from published Python source. Not mixed with prose notes.
- removed:
property Settings.CORS_REPLACE_HTTPS_REFERER -> bool - added:
property Settings.CORS_ALLOW_PRIVATE_NETWORK -> bool
- removed:
class CorsPostCsrfMiddleware(MiddlewareMixin) - removed:
method CorsMiddleware.process_request(request: HttpRequest) -> HttpResponse | None - removed:
method CorsMiddleware.process_response(request: HttpRequest, response: HttpResponse) -> HttpResponse - removed:
method CorsMiddleware.process_view(request: HttpRequest, callback: Any, callback_args: Any, callback_kwargs: Any) -> None - removed:
method CorsPostCsrfMiddleware.process_request(request: HttpRequest) -> None - removed:
method CorsPostCsrfMiddleware.process_view(request: HttpRequest, callback: Any, callback_args: Any, callback_kwargs: Any) -> None - changed:
class CorsMiddleware(MiddlewareMixin) → class CorsMiddleware - added:
constructor CorsMiddleware(get_response: Callable[[HttpRequest], HttpResponseBase] | Callable[[HttpRequest], Awaitable[HttpResponseBase]]) -> None - added:
field CorsMiddleware.async_capable - added:
field CorsMiddleware.sync_capable - added:
method CorsMiddleware.add_response_headers(request: HttpRequest, response: HttpResponseBase) -> HttpResponseBase - added:
method CorsMiddleware.check_preflight(request: HttpRequest) -> HttpResponseBase | None - added:
variable ACCESS_CONTROL_ALLOW_PRIVATE_NETWORK - added:
variable ACCESS_CONTROL_REQUEST_PRIVATE_NETWORK