Bind an artifact link to its public origin before building the URL

Fix one object, revision and public destination

A console offers a link to an AI-generated summary. The user should reach the authenticated delivery service for artifact E-A, revision R-A, at configured public origin O-A. Trusted routing supplies owned route P-A. These are invented labels, not actual URLs, paths or artifacts.

This profile permits one application-owned root-relative route, with no caller-selected authority, scheme, query or fragment. It excludes bearer links, redirects, reset credentials and custom-domain routing. The delivery service still checks current user, object and revision rights. Producing a familiar-looking link does not grant those rights.

The two primary references identify Django documentation version 6.0, not an installed patch release or deployment. Their API semantics support a proposed worksheet; they do not verify ingress, effective settings or a real link.

Identify the helper branch before trusting its result

HttpRequest.build_absolute_uri(location) leaves an already absolute URI unchanged. Otherwise it builds from request server variables; omitting location uses get_full_path(), including any query string. For relative construction, the documentation describes using the current request’s scheme. Do not extend that statement into a rewrite guarantee for supplied absolute locations.

For this workflow, P-A must be supplied explicitly. Passing a model-proposed absolute destination is outside the contract, even if it parses. An authority-bearing proposal also fails the owned-route gate before the helper; this worksheet makes no claim about its exact normalization or return value.

O-A is an application requirement, not an origin argument accepted by this helper. Merely storing O-A in configuration does not force a request-derived result to use it. Either the reviewed request context supports the selected origin or this path must hold construction; it must not silently accept an internal host or choose a guessed replacement.

Separate host admission from exact origin choice

get_host() prefers X-Forwarded-Host when enabled, then Host, then server-name/port information if neither supplies a value. Invalid or disallowed hosts raise DisallowedHost. This describes request-host admission, not validation of every proposed destination.

ALLOWED_HOSTS checks names case-insensitively without the port. Its wildcard forms can admit more than one host. Direct Host access through request.META bypasses get_host() validation. Therefore even accepted host metadata does not settle the exact scheme, host and port required by O-A.

USE_X_FORWARDED_HOST defaults to False and should only be enabled with a proxy that sets it. Record the effective value and provenance requirement, rather than treating a forwarded field’s presence as evidence. The proposed application additionally requires trusted stripping/replacement of caller forwarding fields and a verified allowed ingress path. Those are deployment prerequisites, not protections demonstrated by this worksheet.

Do not infer transport from a forwarded string

SECURE_PROXY_SSL_HEADER controls is_secure() using a configured header/value pair. For the documented forwarded-protocol example, a matching leftmost value in a comma-separated list also qualifies. Django requires a controlled proxy that strips incoming versions, including lists, and sets the field only for originally HTTPS requests.

This profile adopts no proxy configuration snippet. Keep the effective setting, host-source choice and observed request-context association as separately required evidence. An HTTPS-looking field is not proof of the original transport, the backend hop or an exclusive trusted path. If those prerequisites cannot be established, mark the link unavailable rather than experimenting with another header or bypass.

Preserve a useful positive association

For the proposed positive, current authorization permits E-A/R-A, trusted configuration fixes O-A, and trusted routing fixes P-A. The declared request context has already been admitted and independently matches O-A. Only then is relative construction eligible under this chosen helper path.

Before displaying a candidate result, require a separately supported comparison of its complete origin and owned route with O-A/P-A. A suffix test or text prefix is not this contract. This article supplies neither a URL parser nor an encoder or comparison implementation. A mismatch fails closed; no automatic rewrite or external fallback is selected.

Keep the object/revision, configured-origin revision, route identity, effective settings snapshot, helper branch and final association disposition in the review record. No secret link, complete headers or protected artifact contents are needed in ordinary diagnostics.

Use eight inert construction cards

Keep the evidence boundary explicit

For these proposed cases, no URL, request, header, proxy, helper, browser or configuration fixture was constructed or executed. No Django import or runtime inspection occurred. Ordinary documentation reads and private editorial file handling are separate.

Boundary is a prelaunch model router with planned request-path checks, not a shipped artifact-link or proxy service. Its synthetic action exercise and existing mock evidence do not establish these Django, ingress or destination properties.