Custom headers missing in requests to Django -

context: i've written django app have deployed elastic beanstalk (aws).

in local development i've been using custom request header session_token can access using request.meta.get('http_session_token'). in production i'm seeing errors because header not accessible (aka missing in requests django server seeing).

additionally other standard headers working fine, custom header missing. note i'm not setting http_authorization, not same issue authorization header missing in django rest_framework, apache blame?.

what going wrong? how can access custom headers on backend in production?

most session_token header stripped something. django security advisory:

when http headers placed wsgi environ, normalized converting uppercase, converting dashes underscores, , prepending http_. instance, header x-auth-user become http_x_auth_user in wsgi environ (and in django's request.meta dictionary).

unfortunately, means wsgi environ cannot distinguish between headers containing dashes , headers containing underscores: x-auth-user , x-auth_user both become http_x_auth_user. means if header used in security-sensitive way (for instance, passing authentication information along front-end proxy), if proxy strips incoming value x-auth-user, attacker may able provide x-auth_user header (with underscore) , bypass protection.

and important bit of information:

in order prevent such attacks, both nginx , apache 2.4+ strip headers containing underscores incoming requests default. django's built-in development server same. django's development server not recommended production use, matching behavior of common production servers reduces surface area behavior changes during deployment.

if have custom headers should use hyphen instead.