ALLOWED_HOSTS configuration in Django - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What does ALLOWED_HOSTS control in Django?

In Django settings, what is the main purpose of the ALLOWED_HOSTS setting?

A It defines the database hosts that Django can connect to for data storage.

B It lists the IP addresses that the Django server will bind to when running.

C It specifies which host/domain names the Django site can serve to prevent HTTP Host header attacks.

D It controls which user agents (browsers) are allowed to access the Django site.

💡 Hint

Think about security and what the Host header in HTTP requests means.

The ALLOWED_HOSTS setting is a security measure in Django. It tells Django which host/domain names it can serve. This helps prevent attackers from sending requests with fake Host headers.

❓ component_behavior

intermediate

What happens if ALLOWED_HOSTS is empty in production?

If you deploy a Django app to production and leave ALLOWED_HOSTS = [], what will happen when a user tries to access the site?

A Django will serve the request normally without restrictions.

B Django will raise a <code>DisallowedHost</code> exception and refuse to serve the request.

C Django will redirect the user to the admin login page automatically.

D Django will log a warning but still serve the request.

💡 Hint

Consider what Django does to protect against unknown hosts.

When ALLOWED_HOSTS is empty, Django will not allow any host headers and will raise a DisallowedHost error for all incoming requests. This prevents serving the app on unknown domains.

📝 Syntax

advanced

Which ALLOWED_HOSTS setting is valid for allowing example.com and localhost?

Choose the correct way to set ALLOWED_HOSTS to allow requests from example.com and localhost.

A ALLOWED_HOSTS = ['example.com', 'localhost']

B ALLOWED_HOSTS = 'example.com, localhost'

C ALLOWED_HOSTS = {'example.com', 'localhost'}

D ALLOWED_HOSTS = ('example.com', 'localhost')

💡 Hint

Remember the type Django expects for ALLOWED_HOSTS.

ALLOWED_HOSTS must be a list of strings. Option A correctly uses a list. Option A is a string, C is a set, and D is a tuple, which Django does not accept.

🔧 Debug

advanced

Why does this ALLOWED_HOSTS setting cause a DisallowedHost error?

Given the setting ALLOWED_HOSTS = ['.example.com'], why might requests to example.com itself cause a DisallowedHost error?

Django

ALLOWED_HOSTS = ['.example.com']

A Because '.example.com' allows subdomains like 'www.example.com' but not the root domain 'example.com'.

B Because the dot at the start is invalid syntax and causes a configuration error.

C Because ALLOWED_HOSTS must include IP addresses, not domain names.

D Because the list must include 'example.com' explicitly without a dot.

💡 Hint

Think about how Django matches hostnames with leading dots.

A leading dot in ALLOWED_HOSTS means allow all subdomains of that domain, but not the domain itself. So '.example.com' allows 'www.example.com' but not 'example.com'.

❓ state_output

expert

What is the output of this Django ALLOWED_HOSTS check code?

Consider this Django snippet checking if a host is allowed:

ALLOWED_HOSTS = ['example.com', '.mysite.org']

hosts_to_test = ['example.com', 'www.mysite.org', 'mysite.org', 'evil.com']

results = []
for host in hosts_to_test:
    try:
        from django.http.request import validate_host
        validate_host(host, ALLOWED_HOSTS)
        results.append(f"{host}: allowed")
    except Exception:
        results.append(f"{host}: disallowed")

print(results)

What will be printed?

Django

ALLOWED_HOSTS = ['example.com', '.mysite.org']

hosts_to_test = ['example.com', 'www.mysite.org', 'mysite.org', 'evil.com']

results = []
for host in hosts_to_test:
    try:
        from django.http.request import validate_host
        validate_host(host, ALLOWED_HOSTS)
        results.append(f"{host}: allowed")
    except Exception:
        results.append(f"{host}: disallowed")

print(results)

A ['example.com: disallowed', 'www.mysite.org: allowed', 'mysite.org: allowed', 'evil.com: disallowed']

B ['example.com: allowed', 'www.mysite.org: allowed', 'mysite.org: allowed', 'evil.com: allowed']

C ['example.com: allowed', 'www.mysite.org: disallowed', 'mysite.org: allowed', 'evil.com: disallowed']

D ['example.com: allowed', 'www.mysite.org: allowed', 'mysite.org: disallowed', 'evil.com: disallowed']

💡 Hint

Recall that '.mysite.org' allows subdomains but not the root domain itself.

The validate_host function checks if the host matches any entry in ALLOWED_HOSTS. 'example.com' matches exactly. 'www.mysite.org' matches the '.mysite.org' wildcard. 'mysite.org' does not match '.mysite.org' because the leading dot only allows subdomains, not the root domain. 'evil.com' is not allowed.