ALLOWED_HOSTS configuration in Django - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What does ALLOWED_HOSTS control in Django?

In Django settings, what is the main purpose of the ALLOWED_HOSTS setting?

A It defines the database hosts that Django can connect to for data storage.

B It lists the IP addresses that the Django server will bind to when running.

C It specifies which host/domain names the Django site can serve to prevent HTTP Host header attacks.

D It controls which user agents (browsers) are allowed to access the Django site.

💡 Hint

Think about security and what the Host header in HTTP requests means.

The ALLOWED_HOSTS setting is a security measure in Django. It tells Django which host/domain names it can serve. This helps prevent attackers from sending requests with fake Host headers.

❓ component_behavior

intermediate

What happens if ALLOWED_HOSTS is empty in production?

If you deploy a Django app to production and leave ALLOWED_HOSTS = [], what will happen when a user tries to access the site?

A Django will serve the request normally without restrictions.

B Django will raise a <code>DisallowedHost</code> exception and refuse to serve the request.

C Django will redirect the user to the admin login page automatically.

D Django will log a warning but still serve the request.

💡 Hint

Consider what Django does to protect against unknown hosts.

When ALLOWED_HOSTS is empty, Django will not allow any host headers and will raise a DisallowedHost error for all incoming requests. This prevents serving the app on unknown domains.

📝 Syntax

advanced

Which ALLOWED_HOSTS setting is valid for allowing example.com and localhost?

Choose the correct way to set ALLOWED_HOSTS to allow requests from example.com and localhost.

A ALLOWED_HOSTS = ['example.com', 'localhost']

B ALLOWED_HOSTS = 'example.com, localhost'

C ALLOWED_HOSTS = {'example.com', 'localhost'}

D ALLOWED_HOSTS = ('example.com', 'localhost')

💡 Hint

Remember the type Django expects for ALLOWED_HOSTS.

ALLOWED_HOSTS must be a list of strings. Option A correctly uses a list. Option A is a string, C is a set, and D is a tuple, which Django does not accept.

🔧 Debug

advanced

Why does this ALLOWED_HOSTS setting cause a DisallowedHost error?

Given the setting ALLOWED_HOSTS = ['.example.com'], why might requests to example.com itself cause a DisallowedHost error?

Django

ALLOWED_HOSTS = ['.example.com']

A Because '.example.com' allows subdomains like 'www.example.com' but not the root domain 'example.com'.

B Because the dot at the start is invalid syntax and causes a configuration error.

C Because ALLOWED_HOSTS must include IP addresses, not domain names.

D Because the list must include 'example.com' explicitly without a dot.

💡 Hint

Think about how Django matches hostnames with leading dots.

A leading dot in ALLOWED_HOSTS means allow all subdomains of that domain, but not the domain itself. So '.example.com' allows 'www.example.com' but not 'example.com'.

❓ state_output

expert

What is the output of this Django ALLOWED_HOSTS check code?

Consider this Django snippet checking if a host is allowed:

ALLOWED_HOSTS = ['example.com', '.mysite.org']

hosts_to_test = ['example.com', 'www.mysite.org', 'mysite.org', 'evil.com']

results = []
for host in hosts_to_test:
    try:
        from django.http.request import validate_host
        validate_host(host, ALLOWED_HOSTS)
        results.append(f"{host}: allowed")
    except Exception:
        results.append(f"{host}: disallowed")

print(results)

What will be printed?

Django

ALLOWED_HOSTS = ['example.com', '.mysite.org']

hosts_to_test = ['example.com', 'www.mysite.org', 'mysite.org', 'evil.com']

results = []
for host in hosts_to_test:
    try:
        from django.http.request import validate_host
        validate_host(host, ALLOWED_HOSTS)
        results.append(f"{host}: allowed")
    except Exception:
        results.append(f"{host}: disallowed")

print(results)

A ['example.com: disallowed', 'www.mysite.org: allowed', 'mysite.org: allowed', 'evil.com: disallowed']

B ['example.com: allowed', 'www.mysite.org: allowed', 'mysite.org: allowed', 'evil.com: allowed']

C ['example.com: allowed', 'www.mysite.org: disallowed', 'mysite.org: allowed', 'evil.com: disallowed']

D ['example.com: allowed', 'www.mysite.org: allowed', 'mysite.org: disallowed', 'evil.com: disallowed']

💡 Hint

Recall that '.mysite.org' allows subdomains but not the root domain itself.

The validate_host function checks if the host matches any entry in ALLOWED_HOSTS. 'example.com' matches exactly. 'www.mysite.org' matches the '.mysite.org' wildcard. 'mysite.org' does not match '.mysite.org' because the leading dot only allows subdomains, not the root domain. 'evil.com' is not allowed.

Practice

1. What is the purpose of the ALLOWED_HOSTS setting in a Django project?

easy

A. It sets the database connection details.

B. It specifies which domain names the Django app can serve.

C. It controls the static files location.

D. It defines the middleware order.

Solution

1. Step 1: Understand the role of ALLOWED_HOSTS

   ALLOWED_HOSTS is a security setting that lists domains your Django app accepts requests from.

2. Step 2: Compare with other settings

   Database, static files, and middleware are configured elsewhere, not in ALLOWED_HOSTS.

3. Final Answer:

   It specifies which domain names the Django app can serve. -> Option B

4. Quick Check:

   ALLOWED_HOSTS controls allowed domains = A [OK]

Hint: ALLOWED_HOSTS lists allowed website domains [OK]

Common Mistakes:

• Confusing ALLOWED_HOSTS with database settings
• Thinking it controls static files
• Assuming it manages middleware

2. Which of the following is the correct way to set ALLOWED_HOSTS to allow only example.com and localhost?

easy

A. ALLOWED_HOSTS = ['example.com', 'localhost']

B. ALLOWED_HOSTS = 'example.com, localhost'

C. ALLOWED_HOSTS = {example.com, localhost}

D. ALLOWED_HOSTS = (example.com, localhost)

Solution

1. Step 1: Identify the correct data type for ALLOWED_HOSTS

   ALLOWED_HOSTS must be a list of strings, so square brackets [] are correct.

2. Step 2: Check each option's syntax

   A uses curly braces with unquoted domains (syntax error); B is a string; D uses parentheses with unquoted domains (syntax error). Only C uses a list of quoted strings correctly. Django expects a list.

3. Final Answer:

   ALLOWED_HOSTS = ['example.com', 'localhost'] -> Option A

4. Quick Check:

   ALLOWED_HOSTS is a list = C [OK]

Hint: Use square brackets for ALLOWED_HOSTS list [OK]

Common Mistakes:

• Using a string instead of a list
• Using curly braces without quotes (syntax error)
• Using parentheses without quotes (syntax error)

3. Given this settings.py snippet:

ALLOWED_HOSTS = ['myapp.com', 'localhost']

What happens if a request comes from evil.com?

medium

A. Django will raise a DisallowedHost error.

B. Django will serve the request normally.

C. Django will redirect to localhost.

D. Django will ignore the ALLOWED_HOSTS setting.

Solution

1. Step 1: Understand ALLOWED_HOSTS behavior

   Requests from domains not in ALLOWED_HOSTS cause Django to raise a DisallowedHost exception.

2. Step 2: Apply to the given domain

   Since 'evil.com' is not in ['myapp.com', 'localhost'], Django blocks the request with an error.

3. Final Answer:

   Django will raise a DisallowedHost error. -> Option A

4. Quick Check:

   Unknown domain request = DisallowedHost error [OK]

Hint: Requests from unknown hosts cause DisallowedHost error [OK]

Common Mistakes:

• Assuming Django serves unknown hosts
• Thinking Django redirects unknown hosts
• Ignoring ALLOWED_HOSTS effect

4. Identify the error in this settings.py snippet:

ALLOWED_HOSTS = example.com, localhost

medium

A. ALLOWED_HOSTS should be a dictionary.

B. ALLOWED_HOSTS should be a string, not a list.

C. The list syntax is correct; no error.

D. Missing quotes around domain names.

Solution

1. Step 1: Check syntax for ALLOWED_HOSTS

   ALLOWED_HOSTS must be a list of strings, so domain names need quotes.

2. Step 2: Identify the error in the snippet

   example.com and localhost are unquoted, causing a syntax error or NameError.

3. Final Answer:

   Missing quotes around domain names. -> Option D

4. Quick Check:

   Domain names need quotes = A [OK]

Hint: Always quote domain names in ALLOWED_HOSTS list [OK]

Common Mistakes:

• Forgetting quotes around domains
• Using wrong data types like dict
• Assuming ALLOWED_HOSTS can be a plain string

5. You want your Django app to accept requests from any domain during development but restrict to mydomain.com in production. Which ALLOWED_HOSTS setup is best?

hard

A. Set ALLOWED_HOSTS = ['localhost'] in production.

B. Set ALLOWED_HOSTS = [] in development and ['*'] in production.

C. Set ALLOWED_HOSTS = ['*'] in development and ['mydomain.com'] in production.

D. Set ALLOWED_HOSTS = ['mydomain.com'] always.

Solution

1. Step 1: Understand wildcard usage in development

   Using ['*'] allows all hosts, useful for development to avoid host errors.

2. Step 2: Restrict hosts in production

   For security, production should specify exact domains like ['mydomain.com'] to block unwanted hosts.

3. Final Answer:

   Set ALLOWED_HOSTS = ['*'] in development and ['mydomain.com'] in production. -> Option C

4. Quick Check:

   Wildcard for dev, specific domain for prod = D [OK]

Hint: Use '*' for dev, specific domains for production [OK]

Common Mistakes:

• Using empty list in development causes errors
• Allowing all hosts in production is unsafe
• Setting localhost only in production blocks real users