Skip to content

Commit

Permalink
CHANGES.rst: remove :ref: usage
Browse files Browse the repository at this point in the history
  • Loading branch information
Gallaecio committed Oct 5, 2021
1 parent 263418a commit 8643db2
Showing 1 changed file with 5 additions and 5 deletions.
10 changes: 5 additions & 5 deletions CHANGES.rst
Original file line number Diff line number Diff line change
Expand Up @@ -6,11 +6,11 @@ Changes

* **Security bug fix:**

If you use :ref:`HttpAuthMiddleware` (i.e. the ``http_user`` and
``http_pass`` spider attributes) for Splash authentication, any non-Splash
request will expose your credentials to the request target. This includes
``robots.txt`` requests sent by Scrapy when the ``ROBOTSTXT_OBEY`` setting
is set to ``True``.
If you use ``HttpAuthMiddleware`` (i.e. the ``http_user`` and ``http_pass``
spider attributes) for Splash authentication, any non-Splash request will
expose your credentials to the request target. This includes ``robots.txt``
requests sent by Scrapy when the ``ROBOTSTXT_OBEY`` setting is set to
``True``.

Use the new ``SPLASH_USER`` and ``SPLASH_PASS`` settings instead to set
your Splash authentication credentials safely.
Expand Down

0 comments on commit 8643db2

Please sign in to comment.