ALLOWED_HOSTS configuration in Django - Performance & Optimization

Performance: ALLOWED_HOSTS configuration

MEDIUM IMPACT

This setting affects server response time and security by controlling which hostnames the Django app will serve, indirectly impacting page load speed by preventing unnecessary processing of invalid requests.

Configuring which hostnames Django should accept requests from

Django

ALLOWED_HOSTS = ['example.com', 'www.example.com']

Restricts requests to known hosts, reducing server overhead and improving security.

📈 Performance GainPrevents processing invalid hosts, saving CPU cycles and improving response speed.

Configuring which hostnames Django should accept requests from

Django

ALLOWED_HOSTS = ['*']

Allows all hosts, which can expose the app to HTTP Host header attacks and unnecessary processing of invalid requests.

📉 Performance CostIncreases server load by processing all incoming requests without filtering, potentially slowing response times under attack.

Performance Comparison

Pattern	Server Request Filtering	Security Risk	Response Time Impact	Verdict
ALLOWED_HOSTS = ['*']	No filtering	High risk of host header attacks	Slower under attack or invalid requests	[X] Bad
ALLOWED_HOSTS = ['example.com']	Filters invalid hosts	Low risk	Faster response by rejecting invalid hosts early	[OK] Good

Rendering Pipeline

ALLOWED_HOSTS is checked early in the Django request handling pipeline before rendering any content. Requests with disallowed hosts are rejected immediately, preventing further processing.

→Request Validation

→Middleware Processing

⚠️ BottleneckNone in rendering pipeline; impact is on server request filtering before rendering.

Optimization Tips

1Always specify exact hostnames in ALLOWED_HOSTS to avoid processing invalid requests.

2Avoid using wildcard '*' in ALLOWED_HOSTS to reduce security risks and server load.

3Proper ALLOWED_HOSTS configuration helps maintain fast and reliable server responses.

Performance Quiz - 3 Questions

What is the main performance benefit of correctly setting ALLOWED_HOSTS in Django?

A It reduces CSS file size.

B It prevents the server from processing requests with invalid host headers.

C It speeds up database queries.

D It improves client-side rendering speed.

DevTools: Network

How to check: Use browser DevTools Network panel to monitor server responses; check for unexpected redirects or errors caused by host header issues.

What to look for: Look for 400 Bad Request errors indicating disallowed hosts or slow responses due to server processing invalid hosts.

Practice

1. What is the purpose of the ALLOWED_HOSTS setting in a Django project?

easy

A. It sets the database connection details.

B. It specifies which domain names the Django app can serve.

C. It controls the static files location.

D. It defines the middleware order.

Solution

1. Step 1: Understand the role of ALLOWED_HOSTS

   ALLOWED_HOSTS is a security setting that lists domains your Django app accepts requests from.

2. Step 2: Compare with other settings

   Database, static files, and middleware are configured elsewhere, not in ALLOWED_HOSTS.

3. Final Answer:

   It specifies which domain names the Django app can serve. -> Option B

4. Quick Check:

   ALLOWED_HOSTS controls allowed domains = A [OK]

Hint: ALLOWED_HOSTS lists allowed website domains [OK]

Common Mistakes:

• Confusing ALLOWED_HOSTS with database settings
• Thinking it controls static files
• Assuming it manages middleware

2. Which of the following is the correct way to set ALLOWED_HOSTS to allow only example.com and localhost?

easy

A. ALLOWED_HOSTS = ['example.com', 'localhost']

B. ALLOWED_HOSTS = 'example.com, localhost'

C. ALLOWED_HOSTS = {example.com, localhost}

D. ALLOWED_HOSTS = (example.com, localhost)

Solution

1. Step 1: Identify the correct data type for ALLOWED_HOSTS

   ALLOWED_HOSTS must be a list of strings, so square brackets [] are correct.

2. Step 2: Check each option's syntax

   A uses curly braces with unquoted domains (syntax error); B is a string; D uses parentheses with unquoted domains (syntax error). Only C uses a list of quoted strings correctly. Django expects a list.

3. Final Answer:

   ALLOWED_HOSTS = ['example.com', 'localhost'] -> Option A

4. Quick Check:

   ALLOWED_HOSTS is a list = C [OK]

Hint: Use square brackets for ALLOWED_HOSTS list [OK]

Common Mistakes:

• Using a string instead of a list
• Using curly braces without quotes (syntax error)
• Using parentheses without quotes (syntax error)

3. Given this settings.py snippet:

ALLOWED_HOSTS = ['myapp.com', 'localhost']

What happens if a request comes from evil.com?

medium

A. Django will raise a DisallowedHost error.

B. Django will serve the request normally.

C. Django will redirect to localhost.

D. Django will ignore the ALLOWED_HOSTS setting.

Solution

1. Step 1: Understand ALLOWED_HOSTS behavior

   Requests from domains not in ALLOWED_HOSTS cause Django to raise a DisallowedHost exception.

2. Step 2: Apply to the given domain

   Since 'evil.com' is not in ['myapp.com', 'localhost'], Django blocks the request with an error.

3. Final Answer:

   Django will raise a DisallowedHost error. -> Option A

4. Quick Check:

   Unknown domain request = DisallowedHost error [OK]

Hint: Requests from unknown hosts cause DisallowedHost error [OK]

Common Mistakes:

• Assuming Django serves unknown hosts
• Thinking Django redirects unknown hosts
• Ignoring ALLOWED_HOSTS effect

4. Identify the error in this settings.py snippet:

ALLOWED_HOSTS = example.com, localhost

medium

A. ALLOWED_HOSTS should be a dictionary.

B. ALLOWED_HOSTS should be a string, not a list.

C. The list syntax is correct; no error.

D. Missing quotes around domain names.

Solution

1. Step 1: Check syntax for ALLOWED_HOSTS

   ALLOWED_HOSTS must be a list of strings, so domain names need quotes.

2. Step 2: Identify the error in the snippet

   example.com and localhost are unquoted, causing a syntax error or NameError.

3. Final Answer:

   Missing quotes around domain names. -> Option D

4. Quick Check:

   Domain names need quotes = A [OK]

Hint: Always quote domain names in ALLOWED_HOSTS list [OK]

Common Mistakes:

• Forgetting quotes around domains
• Using wrong data types like dict
• Assuming ALLOWED_HOSTS can be a plain string

5. You want your Django app to accept requests from any domain during development but restrict to mydomain.com in production. Which ALLOWED_HOSTS setup is best?

hard

A. Set ALLOWED_HOSTS = ['localhost'] in production.

B. Set ALLOWED_HOSTS = [] in development and ['*'] in production.

C. Set ALLOWED_HOSTS = ['*'] in development and ['mydomain.com'] in production.

D. Set ALLOWED_HOSTS = ['mydomain.com'] always.

Solution

1. Step 1: Understand wildcard usage in development

   Using ['*'] allows all hosts, useful for development to avoid host errors.

2. Step 2: Restrict hosts in production

   For security, production should specify exact domains like ['mydomain.com'] to block unwanted hosts.

3. Final Answer:

   Set ALLOWED_HOSTS = ['*'] in development and ['mydomain.com'] in production. -> Option C

4. Quick Check:

   Wildcard for dev, specific domain for prod = D [OK]

Hint: Use '*' for dev, specific domains for production [OK]

Common Mistakes:

• Using empty list in development causes errors
• Allowing all hosts in production is unsafe
• Setting localhost only in production blocks real users