Django: Fix version 5.0’s URLField.assume_scheme warnings

Since Django’s inception, the web has gradually moved from HTTP to HTTPS, a welcome move for security. But the history has meant older parts of Django have had a lingering HTTP bias. Many of these have been migrated to default to HTTPS instead in previous versions. Django 5.0 starts the migration of another, tiny HTTP bias in forms.URLField.

The old behaviour: when URLField is provided a URL without a scheme, it assumes it to be “http”:

In [1]: from django import forms

In [2]: forms.URLField().to_python('example.com')
Out[2]: 'http://example.com'

Django 5.0 has started a deprecation process to change this default to “https” (Ticket #34380). This version shows a PendingDeprecationWarning when instantiating a URLField:

In [1]: from django import forms

In [2]: forms.URLField().to_python('example.com')
<ipython-...>:1: RemovedInDjango60Warning: The default scheme will be changed from 'http' to 'https' in Django 6.0. Pass the forms.URLField.assume_scheme argument to silence this warning.
  forms.URLField().to_python('example.com')
Out[2]: 'http://example.com'

Here’s that warning message in a more readable format:

RemovedInDjango60Warning: The default scheme will be changed from 'http' to 'https' in Django 6.0. Pass the forms.URLField.assume_scheme argument to silence this warning.

Django 5.1 will turn that into a DeprecationWarning and Django 6.0 will change the default and remove the warning.

Here’s the related release note:

The default scheme for forms.URLField will change from "http" to "https" in Django 6.0. Set FORMS_URLFIELD_ASSUME_HTTPS transitional setting to True to opt into assuming "https" during the Django 5.x release cycle.

Update (2023-12-11): Added the following note about <input type=url> after John-Scott Atlakson pointed out the behaviour on the forum.

Receiving a schemeless URL in a URLField should actually be quite rare. By default, a URLField renders as <input type=url>:

In [1]: from django import forms

In [2]: class CheckForm(forms.Form):
   ...:     url = forms.URLField(label="URL to check")
   ...:

In [3]: print(CheckForm()["url"].as_field_group())
<label for="id_url">URL to check:</label>



<input type="url" name="url" required id="id_url">

Browsers’ client-side validation for <input type=url> requires a scheme for URLs. To hit the “assume scheme” code path, the field will need to use a different widget or template, or the client-side validation would need to be disabled.

But still, until Django 6.0, there’s this new warning to account for. You can control the warning in one of two ways:

1. Adopt the future behaviour with the FORMS_URLFIELD_ASSUME_HTTPS transitional setting.
2. Migrate individual forms.URLField instances by adding the assume_scheme argument.

We’ll cover both of those options below.

I think the first option is suitable for most projects, where there are likely few concerns around users entering schemeless HTTP URLs. Most links are copy-pasted from the browser, in which case they come with a scheme. For the rest, Google Chrome statistics show >93% of page loads use HTTPS. Also, if you go with the second option, you’ll need to deal with warnings for every forms.URLField in your project which can be a lot of work.

FORMS_URLFIELD_ASSUME_HTTPS = True

from warnings import filterwarnings

filterwarnings(
    "ignore", "The FORMS_URLFIELD_ASSUME_HTTPS transitional setting is deprecated."
)
FORMS_URLFIELD_ASSUME_HTTPS = True

from django import forms


class CheckForm(forms.Form):
    url = forms.URLField(label="URL to check", assume_scheme="https")

from functools import partial

from django import forms


HTTPSURLField = partial(forms.URLField, assume_scheme="https")


class CheckForm(forms.Form):
    url = HTTPSURLField(label="URL to check")

from django import forms
from django.db import models

from example.models import NicheMuseum


def urlfields_assume_https(db_field, **kwargs):
    """
    ModelForm.Meta.formfield_callback function to assume HTTPS for scheme-less
    domains in URLFields.
    """
    if isinstance(db_field, models.URLField):
        kwargs["assume_scheme"] = "https"
    return db_field.formfield(**kwargs)


class NicheMuseumForm(forms.ModelForm):
    class Meta:
        model = NicheMuseum
        fields = ["name", "website"]
        formfield_callback = urlfields_assume_https

$ python -Xdev manage.py runserver
Watching for file changes with StatReloader
Performing system checks...

...
/.../django/db/models/fields/__init__.py:1140: RemovedInDjango60Warning: The default scheme will be changed from 'http' to 'https' in Django 6.0. Pass the forms.URLField.assume_scheme argument to silence this warning.
  return form_class(**defaults)
[25/Nov/2023 16:37:34] "GET /admin/example/nichemuseum/add/ HTTP/1.1" 200 8907
...

from django.contrib import admin
from django.contrib.admin.options import BaseModelAdmin
from django.db import models

from example.models import NicheMuseum

# Custom admin classes for project-level modifications


class AdminMixin(BaseModelAdmin):
    def formfield_for_dbfield(self, db_field, request, **kwargs):
        """
        Assume HTTPS for scheme-less domains pasted into URLFields.
        """
        if isinstance(db_field, models.URLField):
            kwargs["assume_scheme"] = "https"
        return super().formfield_for_dbfield(db_field, request, **kwargs)


class ModelAdmin(AdminMixin, admin.ModelAdmin):
    pass


class StackedInline(AdminMixin, admin.StackedInline):
    pass


class TabularInline(AdminMixin, admin.TabularInline):
    pass


# Admin classes


@admin.register(NicheMuseum)
class NicheMuseumAdmin(ModelAdmin):
    ...

from functools import partial

import django
from django import forms

if django.VERSION >= (5, 0):
    URLField = partial(forms.URLField, assume_scheme="https")
else:
    URLField = forms.URLField


class CheckForm(forms.Form):
    url = URLField(label="URL to check")

Read my book Boost Your Git DX to Git better.

One summary email a week, no spam, I pinky promise.

Tags: django