Request and response objects¶
Quick overview¶
Django uses request and response objects to pass state through the system.
When a page is requested, Django creates an HttpRequest
object that
contains metadata about the request. Then Django loads the appropriate view,
passing the HttpRequest
as the first argument to the view function.
Each view is responsible for returning an HttpResponse
object.
This document explains the APIs for HttpRequest
and
HttpResponse
objects, which are defined in the django.http
module.
HttpRequest
objects¶
-
class
HttpRequest
¶
Attributes¶
All attributes should be considered read-only, unless stated otherwise.
-
HttpRequest.
scheme
¶ A string representing the scheme of the request (
http
orhttps
usually).
-
HttpRequest.
body
¶ The raw HTTP request body as a bytestring. This is useful for processing data in different ways than conventional HTML forms: binary images, XML payload etc. For processing conventional form data, use
HttpRequest.POST
.You can also read from an
HttpRequest
using a file-like interface withHttpRequest.read()
orHttpRequest.readline()
. Accessing thebody
attribute after reading the request with either of these I/O stream methods will produce aRawPostDataException
.
-
HttpRequest.
path
¶ A string representing the full path to the requested page, not including the scheme, domain, or query string.
Example:
"/music/bands/the_beatles/"
-
HttpRequest.
path_info
¶ Under some web server configurations, the portion of the URL after the host name is split up into a script prefix portion and a path info portion. The
path_info
attribute always contains the path info portion of the path, no matter what web server is being used. Using this instead ofpath
can make your code easier to move between test and deployment servers.For example, if the
WSGIScriptAlias
for your application is set to"/minfo"
, thenpath
might be"/minfo/music/bands/the_beatles/"
andpath_info
would be"/music/bands/the_beatles/"
.
-
HttpRequest.
method
¶ A string representing the HTTP method used in the request. This is guaranteed to be uppercase. For example:
if request.method == "GET": do_something() elif request.method == "POST": do_something_else()
-
HttpRequest.
encoding
¶ A string representing the current encoding used to decode form submission data (or
None
, which means theDEFAULT_CHARSET
setting is used). You can write to this attribute to change the encoding used when accessing the form data. Any subsequent attribute accesses (such as reading fromGET
orPOST
) will use the newencoding
value. Useful if you know the form data is not in theDEFAULT_CHARSET
encoding.
-
HttpRequest.
content_type
¶ A string representing the MIME type of the request, parsed from the
CONTENT_TYPE
header.
-
HttpRequest.
content_params
¶ A dictionary of key/value parameters included in the
CONTENT_TYPE
header.
-
HttpRequest.
GET
¶ A dictionary-like object containing all given HTTP GET parameters. See the
QueryDict
documentation below.
-
HttpRequest.
POST
¶ A dictionary-like object containing all given HTTP POST parameters, providing that the request contains form data. See the
QueryDict
documentation below. If you need to access raw or non-form data posted in the request, access this through theHttpRequest.body
attribute instead.It’s possible that a request can come in via POST with an empty
POST
dictionary – if, say, a form is requested via the POST HTTP method but does not include form data. Therefore, you shouldn’t useif request.POST
to check for use of the POST method; instead, useif request.method == "POST"
(seeHttpRequest.method
).POST
does not include file-upload information. SeeFILES
.
-
HttpRequest.
COOKIES
¶ A dictionary containing all cookies. Keys and values are strings.
-
HttpRequest.
FILES
¶ A dictionary-like object containing all uploaded files. Each key in
FILES
is thename
from the<input type="file" name="">
. Each value inFILES
is anUploadedFile
.See Managing files for more information.
FILES
will only contain data if the request method was POST and the<form>
that posted to the request hadenctype="multipart/form-data"
. Otherwise,FILES
will be a blank dictionary-like object.
-
HttpRequest.
META
¶ A dictionary containing all available HTTP headers. Available headers depend on the client and server, but here are some examples:
CONTENT_LENGTH
– The length of the request body (as a string).CONTENT_TYPE
– The MIME type of the request body.HTTP_ACCEPT
– Acceptable content types for the response.HTTP_ACCEPT_ENCODING
– Acceptable encodings for the response.HTTP_ACCEPT_LANGUAGE
– Acceptable languages for the response.HTTP_HOST
– The HTTP Host header sent by the client.HTTP_REFERER
– The referring page, if any.HTTP_USER_AGENT
– The client’s user-agent string.QUERY_STRING
– The query string, as a single (unparsed) string.REMOTE_ADDR
– The IP address of the client.REMOTE_HOST
– The hostname of the client.REMOTE_USER
– The user authenticated by the web server, if any.REQUEST_METHOD
– A string such as"GET"
or"POST"
.SERVER_NAME
– The hostname of the server.SERVER_PORT
– The port of the server (as a string).
With the exception of
CONTENT_LENGTH
andCONTENT_TYPE
, as given above, any HTTP headers in the request are converted toMETA
keys by converting all characters to uppercase, replacing any hyphens with underscores and adding anHTTP_
prefix to the name. So, for example, a header calledX-Bender
would be mapped to theMETA
keyHTTP_X_BENDER
.Note that
runserver
strips all headers with underscores in the name, so you won’t see them inMETA
. This prevents header-spoofing based on ambiguity between underscores and dashes both being normalizing to underscores in WSGI environment variables. It matches the behavior of web servers like Nginx and Apache 2.4+.HttpRequest.headers
is a simpler way to access all HTTP-prefixed headers, plusCONTENT_LENGTH
andCONTENT_TYPE
.
-
HttpRequest.
headers
¶ A case insensitive, dict-like object that provides access to all HTTP-prefixed headers (plus
Content-Length
andContent-Type
) from the request.The name of each header is stylized with title-casing (e.g.
User-Agent
) when it’s displayed. You can access headers case-insensitively:>>> request.headers {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6', ...} >>> "User-Agent" in request.headers True >>> "user-agent" in request.headers True >>> request.headers["User-Agent"] Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) >>> request.headers["user-agent"] Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) >>> request.headers.get("User-Agent") Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) >>> request.headers.get("user-agent") Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6)
For use in, for example, Django templates, headers can also be looked up using underscores in place of hyphens:
{{ request.headers.user_agent }}
-
HttpRequest.
resolver_match
¶ An instance of
ResolverMatch
representing the resolved URL. This attribute is only set after URL resolving took place, which means it’s available in all views but not in middleware which are executed before URL resolving takes place (you can use it inprocess_view()
though).
Attributes set by application code¶
Django doesn’t set these attributes itself but makes use of them if set by your application.
-
HttpRequest.
current_app
¶ The
url
template tag will use its value as thecurrent_app
argument toreverse()
.
-
HttpRequest.
urlconf
¶ This will be used as the root URLconf for the current request, overriding the
ROOT_URLCONF
setting. See How Django processes a request for details.urlconf
can be set toNone
to revert any changes made by previous middleware and return to using theROOT_URLCONF
.
-
HttpRequest.
exception_reporter_filter
¶ This will be used instead of
DEFAULT_EXCEPTION_REPORTER_FILTER
for the current request. See Custom error reports for details.
-
HttpRequest.
exception_reporter_class
¶ This will be used instead of
DEFAULT_EXCEPTION_REPORTER
for the current request. See Custom error reports for details.
Attributes set by middleware¶
Some of the middleware included in Django’s contrib apps set attributes on the
request. If you don’t see the attribute on a request, be sure the appropriate
middleware class is listed in MIDDLEWARE
.
-
HttpRequest.
session
¶ From the
SessionMiddleware
: A readable and writable, dictionary-like object that represents the current session.
-
HttpRequest.
site
¶ From the
CurrentSiteMiddleware
: An instance ofSite
orRequestSite
as returned byget_current_site()
representing the current site.
-
HttpRequest.
user
¶ From the
AuthenticationMiddleware
: An instance ofAUTH_USER_MODEL
representing the currently logged-in user. If the user isn’t currently logged in,user
will be set to an instance ofAnonymousUser
. You can tell them apart withis_authenticated
, like so:if request.user.is_authenticated: ... # Do something for logged-in users. else: ... # Do something for anonymous users.
The
auser()
method does the same thing but can be used from async contexts.
Methods¶
-
HttpRequest.
auser
()¶ - New in Django 5.0.
From the
AuthenticationMiddleware
: Coroutine. Returns an instance ofAUTH_USER_MODEL
representing the currently logged-in user. If the user isn’t currently logged in,auser
will return an instance ofAnonymousUser
. This is similar to theuser
attribute but it works in async contexts.
-
HttpRequest.
get_host
()¶ Returns the originating host of the request using information from the
HTTP_X_FORWARDED_HOST
(ifUSE_X_FORWARDED_HOST
is enabled) andHTTP_HOST
headers, in that order. If they don’t provide a value, the method uses a combination ofSERVER_NAME
andSERVER_PORT
as detailed in PEP 3333.Example:
"127.0.0.1:8000"
Raises
django.core.exceptions.DisallowedHost
if the host is not inALLOWED_HOSTS
or the domain name is invalid according to RFC 1034/1035.Note
The
get_host()
method fails when the host is behind multiple proxies. One solution is to use middleware to rewrite the proxy headers, as in the following example:class MultipleProxyMiddleware: FORWARDED_FOR_FIELDS = [ "HTTP_X_FORWARDED_FOR", "HTTP_X_FORWARDED_HOST", "HTTP_X_FORWARDED_SERVER", ] def __init__(self, get_response): self.get_response = get_response def __call__(self, request): """ Rewrites the proxy headers so that only the most recent proxy is used. """ for field in self.FORWARDED_FOR_FIELDS: if field in request.META: if "," in request.META[field]: parts = request.META[field].split(",") request.META[field] = parts[-1].strip() return self.get_response(request)
This middleware should be positioned before any other middleware that relies on the value of
get_host()
– for instance,CommonMiddleware
orCsrfViewMiddleware
.
-
HttpRequest.
get_port
()¶ Returns the originating port of the request using information from the
HTTP_X_FORWARDED_PORT
(ifUSE_X_FORWARDED_PORT
is enabled) andSERVER_PORT
META
variables, in that order.
-
HttpRequest.
get_full_path
()¶ Returns the
path
, plus an appended query string, if applicable.Example:
"/music/bands/the_beatles/?print=true"
-
HttpRequest.
get_full_path_info
()¶ Like
get_full_path()
, but usespath_info
instead ofpath
.Example:
"/minfo/music/bands/the_beatles/?print=true"
-
HttpRequest.
build_absolute_uri
(location=None)¶ Returns the absolute URI form of
location
. If no location is provided, the location will be set torequest.get_full_path()
.If the location is already an absolute URI, it will not be altered. Otherwise the absolute URI is built using the server variables available in this request. For example:
>>> request.build_absolute_uri() 'https://example.com/music/bands/the_beatles/?print=true' >>> request.build_absolute_uri("/bands/") 'https://example.com/bands/' >>> request.build_absolute_uri("https://example2.com/bands/") 'https://example2.com/bands/'
Note
Mixing HTTP and HTTPS on the same site is discouraged, therefore
build_absolute_uri()
will always generate an absolute URI with the same scheme the current request has. If you need to redirect users to HTTPS, it’s best to let your web server redirect all HTTP traffic to HTTPS.
-
HttpRequest.
get_signed_cookie
(key, default=RAISE_ERROR, salt='', max_age=None)¶ Returns a cookie value for a signed cookie, or raises a
django.core.signing.BadSignature
exception if the signature is no longer valid. If you provide thedefault
argument the exception will be suppressed and that default value will be returned instead.The optional
salt
argument can be used to provide extra protection against brute force attacks on your secret key. If supplied, themax_age
argument will be checked against the signed timestamp attached to the cookie value to ensure the cookie is not older thanmax_age
seconds.For example:
>>> request.get_signed_cookie("name") 'Tony' >>> request.get_signed_cookie("name", salt="name-salt") 'Tony' # assuming cookie was set using the same salt >>> request.get_signed_cookie("nonexistent-cookie") KeyError: 'nonexistent-cookie' >>> request.get_signed_cookie("nonexistent-cookie", False) False >>> request.get_signed_cookie("cookie-that-was-tampered-with") BadSignature: ... >>> request.get_signed_cookie("name", max_age=60) SignatureExpired: Signature age 1677.3839159 > 60 seconds >>> request.get_signed_cookie("name", False, max_age=60) False
See cryptographic signing for more information.
-
HttpRequest.
is_secure
()¶ Returns
True
if the request is secure; that is, if it was made with HTTPS.
-
HttpRequest.
accepts
(mime_type)¶ Returns
True
if the requestAccept
header matches themime_type
argument:>>> request.accepts("text/html") True
Most browsers send
Accept: */*
by default, so this would returnTrue
for all content types. Setting an explicitAccept
header in API requests can be useful for returning a different content type for those consumers only. See Content negotiation example of usingaccepts()
to return different content to API consumers.If a response varies depending on the content of the
Accept
header and you are using some form of caching like Django’scache middleware
, you should decorate the view withvary_on_headers('Accept')
so that the responses are properly cached.
-
HttpRequest.
read
(size=None)¶
-
HttpRequest.
readline
()¶
-
HttpRequest.
readlines
()¶
-
HttpRequest.
__iter__
()¶ Methods implementing a file-like interface for reading from an
HttpRequest
instance. This makes it possible to consume an incoming request in a streaming fashion. A common use-case would be to process a big XML payload with an iterative parser without constructing a whole XML tree in memory.Given this standard interface, an
HttpRequest
instance can be passed directly to an XML parser such asElementTree
:import xml.etree.ElementTree as ET for element in ET.iterparse(request): process(element)
QueryDict
objects¶
-
class
QueryDict
¶
In an HttpRequest
object, the GET
and
POST
attributes are instances of django.http.QueryDict
,
a dictionary-like class customized to deal with multiple values for the same
key. This is necessary because some HTML form elements, notably
<select multiple>
, pass multiple values for the same key.
The QueryDict
s at request.POST
and request.GET
will be immutable
when accessed in a normal request/response cycle. To get a mutable version you
need to use QueryDict.copy()
.
Methods¶
QueryDict
implements all the standard dictionary methods because it’s
a subclass of dictionary. Exceptions are outlined here:
-
QueryDict.
__init__
(query_string=None, mutable=False, encoding=None)¶ Instantiates a
QueryDict
object based onquery_string
.>>> QueryDict("a=1&a=2&c=3") <QueryDict: {'a': ['1', '2'], 'c': ['3']}>
If
query_string
is not passed in, the resultingQueryDict
will be empty (it will have no keys or values).Most
QueryDict
s you encounter, and in particular those atrequest.POST
andrequest.GET
, will be immutable. If you are instantiating one yourself, you can make it mutable by passingmutable=True
to its__init__()
.Strings for setting both keys and values will be converted from
encoding
tostr
. Ifencoding
is not set, it defaults toDEFAULT_CHARSET
.
-
classmethod
QueryDict.
fromkeys
(iterable, value='', mutable=False, encoding=None)¶ Creates a new
QueryDict
with keys fromiterable
and each value equal tovalue
. For example:>>> QueryDict.fromkeys(["a", "a", "b"], value="val") <QueryDict: {'a': ['val', 'val'], 'b': ['val']}>
-
QueryDict.
__getitem__
(key)¶ Returns the value for the given key. If the key has more than one value, it returns the last value. Raises
django.utils.datastructures.MultiValueDictKeyError
if the key does not exist. (This is a subclass of Python’s standardKeyError
, so you can stick to catchingKeyError
.)
-
QueryDict.
__setitem__
(key, value)¶ Sets the given key to
[value]
(a list whose single element isvalue
). Note that this, as other dictionary functions that have side effects, can only be called on a mutableQueryDict
(such as one that was created viaQueryDict.copy()
).
-
QueryDict.
__contains__
(key)¶ Returns
True
if the given key is set. This lets you do, e.g.,if "foo" in request.GET
.
-
QueryDict.
get
(key, default=None)¶ Uses the same logic as
__getitem__()
, with a hook for returning a default value if the key doesn’t exist.
-
QueryDict.
setdefault
(key, default=None)¶ Like
dict.setdefault()
, except it uses__setitem__()
internally.
-
QueryDict.
update
(other_dict)¶ Takes either a
QueryDict
or a dictionary. Likedict.update()
, except it appends to the current dictionary items rather than replacing them. For example:>>> q = QueryDict("a=1", mutable=True) >>> q.update({"a": "2"}) >>> q.getlist("a") ['1', '2'] >>> q["a"] # returns the last '2'
-
QueryDict.
items
()¶ Like
dict.items()
, except this uses the same last-value logic as__getitem__()
and returns an iterator object instead of a view object. For example:>>> q = QueryDict("a=1&a=2&a=3") >>> list(q.items()) [('a', '3')]
-
QueryDict.
values
()¶ Like
dict.values()
, except this uses the same last-value logic as__getitem__()
and returns an iterator instead of a view object. For example:>>> q = QueryDict("a=1&a=2&a=3") >>> list(q.values()) ['3']
In addition, QueryDict
has the following methods:
-
QueryDict.
copy
()¶ Returns a copy of the object using
copy.deepcopy()
. This copy will be mutable even if the original was not.
-
QueryDict.
getlist
(key, default=None)¶ Returns a list of the data with the requested key. Returns an empty list if the key doesn’t exist and
default
isNone
. It’s guaranteed to return a list unless the default value provided isn’t a list.
-
QueryDict.
setlist
(key, list_)¶ Sets the given key to
list_
(unlike__setitem__()
).
-
QueryDict.
appendlist
(key, item)¶ Appends an item to the internal list associated with key.
-
QueryDict.
setlistdefault
(key, default_list=None)¶ Like
setdefault()
, except it takes a list of values instead of a single value.
-
QueryDict.
lists
()¶ Like
items()
, except it includes all values, as a list, for each member of the dictionary. For example:>>> q = QueryDict("a=1&a=2&a=3") >>> q.lists() [('a', ['1', '2', '3'])]
-
QueryDict.
pop
(key)¶ Returns a list of values for the given key and removes them from the dictionary. Raises
KeyError
if the key does not exist. For example:>>> q = QueryDict("a=1&a=2&a=3", mutable=True) >>> q.pop("a") ['1', '2', '3']
-
QueryDict.
popitem
()¶ Removes an arbitrary member of the dictionary (since there’s no concept of ordering), and returns a two value tuple containing the key and a list of all values for the key. Raises
KeyError
when called on an empty dictionary. For example:>>> q = QueryDict("a=1&a=2&a=3", mutable=True) >>> q.popitem() ('a', ['1', '2', '3'])
-
QueryDict.
dict
()¶ Returns a
dict
representation ofQueryDict
. For every (key, list) pair inQueryDict
,dict
will have (key, item), where item is one element of the list, using the same logic asQueryDict.__getitem__()
:>>> q = QueryDict("a=1&a=3&a=5") >>> q.dict() {'a': '5'}
-
QueryDict.
urlencode
(safe=None)¶ Returns a string of the data in query string format. For example:
>>> q = QueryDict("a=2&b=3&b=5") >>> q.urlencode() 'a=2&b=3&b=5'
Use the
safe
parameter to pass characters which don’t require encoding. For example:>>> q = QueryDict(mutable=True) >>> q["next"] = "/a&b/" >>> q.urlencode(safe="/") 'next=/a%26b/'
HttpResponse
objects¶
-
class
HttpResponse
¶
In contrast to HttpRequest
objects, which are created automatically by
Django, HttpResponse
objects are your responsibility. Each view you
write is responsible for instantiating, populating, and returning an
HttpResponse
.
The HttpResponse
class lives in the django.http
module.
Usage¶
Passing strings¶
Typical usage is to pass the contents of the page, as a string, bytestring,
or memoryview
, to the HttpResponse
constructor:
>>> from django.http import HttpResponse
>>> response = HttpResponse("Here's the text of the web page.")
>>> response = HttpResponse("Text only, please.", content_type="text/plain")
>>> response = HttpResponse(b"Bytestrings are also accepted.")
>>> response = HttpResponse(memoryview(b"Memoryview as well."))
But if you want to add content incrementally, you can use response
as a
file-like object:
>>> response = HttpResponse()
>>> response.write("<p>Here's the text of the web page.</p>")
>>> response.write("<p>Here's another paragraph.</p>")
Passing iterators¶
Finally, you can pass HttpResponse
an iterator rather than strings.
HttpResponse
will consume the iterator immediately, store its content as a
string, and discard it. Objects with a close()
method such as files and
generators are immediately closed.
If you need the response to be streamed from the iterator to the client, you
must use the StreamingHttpResponse
class instead.
Setting header fields¶
To set or remove a header field in your response, use
HttpResponse.headers
:
>>> response = HttpResponse()
>>> response.headers["Age"] = 120
>>> del response.headers["Age"]
You can also manipulate headers by treating your response like a dictionary:
>>> response = HttpResponse()
>>> response["Age"] = 120
>>> del response["Age"]
This proxies to HttpResponse.headers
, and is the original interface offered
by HttpResponse
.
When using this interface, unlike a dictionary, del
doesn’t raise
KeyError
if the header field doesn’t exist.
You can also set headers on instantiation:
>>> response = HttpResponse(headers={"Age": 120})
For setting the Cache-Control
and Vary
header fields, it is recommended
to use the patch_cache_control()
and
patch_vary_headers()
methods from
django.utils.cache
, since these fields can have multiple, comma-separated
values. The “patch” methods ensure that other values, e.g. added by a
middleware, are not removed.
HTTP header fields cannot contain newlines. An attempt to set a header field
containing a newline character (CR or LF) will raise BadHeaderError
Telling the browser to treat the response as a file attachment¶
To tell the browser to treat the response as a file attachment, set the
Content-Type
and Content-Disposition
headers. For example, this is how
you might return a Microsoft Excel spreadsheet:
>>> response = HttpResponse(
... my_data,
... headers={
... "Content-Type": "application/vnd.ms-excel",
... "Content-Disposition": 'attachment; filename="foo.xls"',
... },
... )
There’s nothing Django-specific about the Content-Disposition
header, but
it’s easy to forget the syntax, so we’ve included it here.
Attributes¶
-
HttpResponse.
content
¶ A bytestring representing the content, encoded from a string if necessary.
-
HttpResponse.
cookies
¶ A
http.cookies.SimpleCookie
object holding the cookies included in the response.
-
HttpResponse.
headers
¶ A case insensitive, dict-like object that provides an interface to all HTTP headers on the response, except a
Set-Cookie
header. See Setting header fields andHttpResponse.cookies
.
-
HttpResponse.
charset
¶ A string denoting the charset in which the response will be encoded. If not given at
HttpResponse
instantiation time, it will be extracted fromcontent_type
and if that is unsuccessful, theDEFAULT_CHARSET
setting will be used.
-
HttpResponse.
status_code
¶ The HTTP status code for the response.
Unless
reason_phrase
is explicitly set, modifying the value ofstatus_code
outside the constructor will also modify the value ofreason_phrase
.
-
HttpResponse.
reason_phrase
¶ The HTTP reason phrase for the response. It uses the HTTP standard’s default reason phrases.
Unless explicitly set,
reason_phrase
is determined by the value ofstatus_code
.
-
HttpResponse.
streaming
¶ This is always
False
.This attribute exists so middleware can treat streaming responses differently from regular responses.
-
HttpResponse.
closed
¶ True
if the response has been closed.
Methods¶
-
HttpResponse.
__init__
(content=b'', content_type=None, status=200, reason=None, charset=None, headers=None)¶ Instantiates an
HttpResponse
object with the given page content, content type, and headers.content
is most commonly an iterator, bytestring,memoryview
, or string. Other types will be converted to a bytestring by encoding their string representation. Iterators should return strings or bytestrings and those will be joined together to form the content of the response.content_type
is the MIME type optionally completed by a character set encoding and is used to fill the HTTPContent-Type
header. If not specified, it is formed by'text/html'
and theDEFAULT_CHARSET
settings, by default:"text/html; charset=utf-8"
.status
is the HTTP status code for the response. You can use Python’shttp.HTTPStatus
for meaningful aliases, such asHTTPStatus.NO_CONTENT
.reason
is the HTTP response phrase. If not provided, a default phrase will be used.charset
is the charset in which the response will be encoded. If not given it will be extracted fromcontent_type
, and if that is unsuccessful, theDEFAULT_CHARSET
setting will be used.headers
is adict
of HTTP headers for the response.
-
HttpResponse.
__setitem__
(header, value)¶ Sets the given header name to the given value. Both
header
andvalue
should be strings.
-
HttpResponse.
__delitem__
(header)¶ Deletes the header with the given name. Fails silently if the header doesn’t exist. Case-insensitive.
-
HttpResponse.
__getitem__
(header)¶ Returns the value for the given header name. Case-insensitive.
-
HttpResponse.
get
(header, alternate=None)¶ Returns the value for the given header, or an
alternate
if the header doesn’t exist.
-
HttpResponse.
has_header
(header)¶ Returns
True
orFalse
based on a case-insensitive check for a header with the given name.
-
HttpResponse.
items
()¶ Acts like
dict.items()
for HTTP headers on the response.
-
HttpResponse.
setdefault
(header, value)¶ Sets a header unless it has already been set.
-
HttpResponse.
set_cookie
(key, value='', max_age=None, expires=None, path='/', domain=None, secure=False, httponly=False, samesite=None)¶ Sets a cookie. The parameters are the same as in the
Morsel
cookie object in the Python standard library.max_age
should be atimedelta
object, an integer number of seconds, orNone
(default) if the cookie should last only as long as the client’s browser session. Ifexpires
is not specified, it will be calculated.expires
should either be a string in the format"Wdy, DD-Mon-YY HH:MM:SS GMT"
or adatetime.datetime
object in UTC. Ifexpires
is adatetime
object, themax_age
will be calculated.Use
domain
if you want to set a cross-domain cookie. For example,domain="example.com"
will set a cookie that is readable by the domains www.example.com, blog.example.com, etc. Otherwise, a cookie will only be readable by the domain that set it.Use
secure=True
if you want the cookie to be only sent to the server when a request is made with thehttps
scheme.Use
httponly=True
if you want to prevent client-side JavaScript from having access to the cookie.HttpOnly is a flag included in a Set-Cookie HTTP response header. It’s part of the RFC 6265 standard for cookies and can be a useful way to mitigate the risk of a client-side script accessing the protected cookie data.
Use
samesite='Strict'
orsamesite='Lax'
to tell the browser not to send this cookie when performing a cross-origin request. SameSite isn’t supported by all browsers, so it’s not a replacement for Django’s CSRF protection, but rather a defense in depth measure.Use
samesite='None'
(string) to explicitly state that this cookie is sent with all same-site and cross-site requests.
Warning
RFC 6265 states that user agents should support cookies of at least 4096 bytes. For many browsers this is also the maximum size. Django will not raise an exception if there’s an attempt to store a cookie of more than 4096 bytes, but many browsers will not set the cookie correctly.
-
HttpResponse.
set_signed_cookie
(key, value, salt='', max_age=None, expires=None, path='/', domain=None, secure=False, httponly=False, samesite=None)¶ Like
set_cookie()
, but cryptographic signing the cookie before setting it. Use in conjunction withHttpRequest.get_signed_cookie()
. You can use the optionalsalt
argument for added key strength, but you will need to remember to pass it to the correspondingHttpRequest.get_signed_cookie()
call.
-
HttpResponse.
delete_cookie
(key, path='/', domain=None, samesite=None)¶ Deletes the cookie with the given key. Fails silently if the key doesn’t exist.
Due to the way cookies work,
path
anddomain
should be the same values you used inset_cookie()
– otherwise the cookie may not be deleted.
-
HttpResponse.
close
()¶ This method is called at the end of the request directly by the WSGI server.
-
HttpResponse.
write
(content)¶ This method makes an
HttpResponse
instance a file-like object.
-
HttpResponse.
flush
()¶ This method makes an
HttpResponse
instance a file-like object.
-
HttpResponse.
tell
()¶ This method makes an
HttpResponse
instance a file-like object.
-
HttpResponse.
getvalue
()¶ Returns the value of
HttpResponse.content
. This method makes anHttpResponse
instance a stream-like object.
-
HttpResponse.
readable
()¶ Always
False
. This method makes anHttpResponse
instance a stream-like object.
-
HttpResponse.
seekable
()¶ Always
False
. This method makes anHttpResponse
instance a stream-like object.
-
HttpResponse.
writable
()¶ Always
True
. This method makes anHttpResponse
instance a stream-like object.
-
HttpResponse.
writelines
(lines)¶ Writes a list of lines to the response. Line separators are not added. This method makes an
HttpResponse
instance a stream-like object.
HttpResponse
subclasses¶
Django includes a number of HttpResponse
subclasses that handle different
types of HTTP responses. Like HttpResponse
, these subclasses live in
django.http
.
-
class
HttpResponseRedirect
¶ The first argument to the constructor is required – the path to redirect to. This can be a fully qualified URL (e.g.
'https://www.yahoo.com/search/'
), an absolute path with no domain (e.g.'/search/'
), or even a relative path (e.g.'search/'
). In that last case, the client browser will reconstruct the full URL itself according to the current path. SeeHttpResponse
for other optional constructor arguments. Note that this returns an HTTP status code 302.-
url
¶ This read-only attribute represents the URL the response will redirect to (equivalent to the
Location
response header).
-
-
class
HttpResponsePermanentRedirect
¶ Like
HttpResponseRedirect
, but it returns a permanent redirect (HTTP status code 301) instead of a “found” redirect (status code 302).
-
class
HttpResponseNotModified
¶ The constructor doesn’t take any arguments and no content should be added to this response. Use this to designate that a page hasn’t been modified since the user’s last request (status code 304).
-
class
HttpResponseBadRequest
¶ Acts just like
HttpResponse
but uses a 400 status code.
-
class
HttpResponseNotFound
¶ Acts just like
HttpResponse
but uses a 404 status code.
-
class
HttpResponseForbidden
¶ Acts just like
HttpResponse
but uses a 403 status code.
-
class
HttpResponseNotAllowed
¶ Like
HttpResponse
, but uses a 405 status code. The first argument to the constructor is required: a list of permitted methods (e.g.['GET', 'POST']
).
-
class
HttpResponseGone
¶ Acts just like
HttpResponse
but uses a 410 status code.
-
class
HttpResponseServerError
¶ Acts just like
HttpResponse
but uses a 500 status code.
Note
If a custom subclass of HttpResponse
implements a render
method, Django will treat it as emulating a
SimpleTemplateResponse
, and the
render
method must itself return a valid response object.
Custom response classes¶
If you find yourself needing a response class that Django doesn’t provide, you
can create it with the help of http.HTTPStatus
. For example:
from http import HTTPStatus
from django.http import HttpResponse
class HttpResponseNoContent(HttpResponse):
status_code = HTTPStatus.NO_CONTENT
JsonResponse
objects¶
-
class
JsonResponse
(data, encoder=DjangoJSONEncoder, safe=True, json_dumps_params=None, **kwargs)¶ An
HttpResponse
subclass that helps to create a JSON-encoded response. It inherits most behavior from its superclass with a couple differences:Its default
Content-Type
header is set to application/json.The first parameter,
data
, should be adict
instance. If thesafe
parameter is set toFalse
(see below) it can be any JSON-serializable object.The
encoder
, which defaults todjango.core.serializers.json.DjangoJSONEncoder
, will be used to serialize the data. See JSON serialization for more details about this serializer.The
safe
boolean parameter defaults toTrue
. If it’s set toFalse
, any object can be passed for serialization (otherwise onlydict
instances are allowed). Ifsafe
isTrue
and a non-dict
object is passed as the first argument, aTypeError
will be raised.The
json_dumps_params
parameter is a dictionary of keyword arguments to pass to thejson.dumps()
call used to generate the response.
Usage¶
Typical usage could look like:
>>> from django.http import JsonResponse
>>> response = JsonResponse({"foo": "bar"})
>>> response.content
b'{"foo": "bar"}'
Serializing non-dictionary objects¶
In order to serialize objects other than dict
you must set the safe
parameter to False
:
>>> response = JsonResponse([1, 2, 3], safe=False)
Without passing safe=False
, a TypeError
will be raised.
Note that an API based on dict
objects is more extensible, flexible, and
makes it easier to maintain forwards compatibility. Therefore, you should avoid
using non-dict objects in JSON-encoded response.
Warning
Before the 5th edition of ECMAScript it was possible to
poison the JavaScript Array
constructor. For this reason, Django does
not allow passing non-dict objects to the
JsonResponse
constructor by default. However, most
modern browsers implement ECMAScript 5 which removes this attack vector.
Therefore it is possible to disable this security precaution.
Changing the default JSON encoder¶
If you need to use a different JSON encoder class you can pass the encoder
parameter to the constructor method:
>>> response = JsonResponse(data, encoder=MyJSONEncoder)
StreamingHttpResponse
objects¶
-
class
StreamingHttpResponse
¶
The StreamingHttpResponse
class is used to stream a response from
Django to the browser.
Advanced usage
StreamingHttpResponse
is somewhat advanced, in that it is
important to know whether you’ll be serving your application synchronously
under WSGI or asynchronously under ASGI, and adjust your usage
appropriately.
Please read these notes with care.
An example usage of StreamingHttpResponse
under WSGI is streaming
content when generating the response would take too long or uses too much
memory. For instance, it’s useful for generating large CSV files.
There are performance considerations when doing this, though. Django, under WSGI, is designed for short-lived requests. Streaming responses will tie a worker process for the entire duration of the response. This may result in poor performance.
Generally speaking, you would perform expensive tasks outside of the request-response cycle, rather than resorting to a streamed response.
When serving under ASGI, however, a StreamingHttpResponse
need not
stop other requests from being served whilst waiting for I/O. This opens up
the possibility of long-lived requests for streaming content and implementing
patterns such as long-polling, and server-sent events.
Even under ASGI note, StreamingHttpResponse
should only be used in
situations where it is absolutely required that the whole content isn’t
iterated before transferring the data to the client. Because the content can’t
be accessed, many middleware can’t function normally. For example the ETag
and Content-Length
headers can’t be generated for streaming responses.
The StreamingHttpResponse
is not a subclass of HttpResponse
,
because it features a slightly different API. However, it is almost identical,
with the following notable differences:
It should be given an iterator that yields bytestrings,
memoryview
, or strings as content. When serving under WSGI, this should be a sync iterator. When serving under ASGI, then it should be an async iterator.You cannot access its content, except by iterating the response object itself. This should only occur when the response is returned to the client: you should not iterate the response yourself.
Under WSGI the response will be iterated synchronously. Under ASGI the response will be iterated asynchronously. (This is why the iterator type must match the protocol you’re using.)
To avoid a crash, an incorrect iterator type will be mapped to the correct type during iteration, and a warning will be raised, but in order to do this the iterator must be fully-consumed, which defeats the purpose of using a
StreamingHttpResponse
at all.It has no
content
attribute. Instead, it has astreaming_content
attribute. This can be used in middleware to wrap the response iterable, but should not be consumed.You cannot use the file-like object
tell()
orwrite()
methods. Doing so will raise an exception.
The HttpResponseBase
base class is common between
HttpResponse
and StreamingHttpResponse
.
Support for asynchronous iteration was added.
Attributes¶
-
StreamingHttpResponse.
streaming_content
¶ An iterator of the response content, bytestring encoded according to
HttpResponse.charset
.
-
StreamingHttpResponse.
status_code
¶ The HTTP status code for the response.
Unless
reason_phrase
is explicitly set, modifying the value ofstatus_code
outside the constructor will also modify the value ofreason_phrase
.
-
StreamingHttpResponse.
reason_phrase
¶ The HTTP reason phrase for the response. It uses the HTTP standard’s default reason phrases.
Unless explicitly set,
reason_phrase
is determined by the value ofstatus_code
.
-
StreamingHttpResponse.
streaming
¶ This is always
True
.
-
StreamingHttpResponse.
is_async
¶ - New in Django 4.2.
Boolean indicating whether
StreamingHttpResponse.streaming_content
is an asynchronous iterator or not.This is useful for middleware needing to wrap
StreamingHttpResponse.streaming_content
.
Handling disconnects¶
If the client disconnects during a streaming response, Django will cancel the
coroutine that is handling the response. If you want to clean up resources
manually, you can do so by catching the asyncio.CancelledError
:
async def streaming_response():
try:
# Do some work here
async for chunk in my_streaming_iterator():
yield chunk
except asyncio.CancelledError:
# Handle disconnect
...
raise
async def my_streaming_view(request):
return StreamingHttpResponse(streaming_response())
This example only shows how to handle client disconnection while the response
is streaming. If you perform long-running operations in your view before
returning the StreamingHttpResponse
object, then you may also want to
handle disconnections in the view itself.
FileResponse
objects¶
-
class
FileResponse
(open_file, as_attachment=False, filename='', **kwargs)¶ FileResponse
is a subclass ofStreamingHttpResponse
optimized for binary files. It uses wsgi.file_wrapper if provided by the wsgi server, otherwise it streams the file out in small chunks.If
as_attachment=True
, theContent-Disposition
header is set toattachment
, which asks the browser to offer the file to the user as a download. Otherwise, aContent-Disposition
header with a value ofinline
(the browser default) will be set only if a filename is available.If
open_file
doesn’t have a name or if the name ofopen_file
isn’t appropriate, provide a custom file name using thefilename
parameter. Note that if you pass a file-like object likeio.BytesIO
, it’s your task toseek()
it before passing it toFileResponse
.The
Content-Length
header is automatically set when it can be guessed from the content ofopen_file
.The
Content-Type
header is automatically set when it can be guessed from thefilename
, or the name ofopen_file
.
FileResponse
accepts any file-like object with binary content, for example
a file open in binary mode like so:
>>> from django.http import FileResponse
>>> response = FileResponse(open("myfile.png", "rb"))
The file will be closed automatically, so don’t open it with a context manager.
Use under ASGI
Python’s file API is synchronous. This means that the file must be fully consumed in order to be served under ASGI.
In order to stream a file asynchronously you need to use a third-party package that provides an asynchronous file API, such as aiofiles.
HttpResponseBase
class¶
-
class
HttpResponseBase
¶
The HttpResponseBase
class is common to all Django responses.
It should not be used to create responses directly, but it can be
useful for type-checking.