ALLOWED_HOSTS configuration in Django - Deep Dive

Overview - ALLOWED_HOSTS configuration

What is it?

ALLOWED_HOSTS is a security setting in Django that lists the host/domain names your web application can serve. It prevents HTTP Host header attacks by ensuring requests come only from trusted sources. You specify it as a list of strings representing domain names or IP addresses. If a request's host is not in this list, Django will reject it.

Why it matters

Without ALLOWED_HOSTS, attackers could send requests with fake host headers to your site, potentially causing security breaches or exposing sensitive data. This setting protects your app by blocking requests from unknown or malicious domains. It helps keep your website safe and trustworthy for users.

Where it fits

Before learning ALLOWED_HOSTS, you should understand basic Django project setup and HTTP requests. After mastering it, you can explore Django security settings like CSRF protection and middleware. It fits into the security layer of Django web development.

Mental Model

Core Idea

ALLOWED_HOSTS is a whitelist that tells Django which domain names it should accept requests from to keep your app safe.

Think of it like...

It's like a guest list at a party: only people whose names are on the list can enter, keeping unwanted visitors out.

┌─────────────────────────────┐
│ Incoming HTTP Request        │
│ Host Header: example.com    │
└──────────────┬──────────────┘
               │
               ▼
┌─────────────────────────────┐
│ Django checks ALLOWED_HOSTS │
│ List: ['example.com', ...]  │
└──────────────┬──────────────┘
               │
     ┌─────────┴─────────┐
     │                   │
     ▼                   ▼
Accept request       Reject request
and process          with error 400

Build-Up - 6 Steps

1

Foundation

What ALLOWED_HOSTS Does

Concept: Introduce the purpose of ALLOWED_HOSTS in Django security.

ALLOWED_HOSTS is a list in your Django settings.py file. It tells Django which domain names your site can respond to. If a request comes with a host not in this list, Django will return an error and not process the request.

Result

Your Django app only accepts requests from domains you trust.

Understanding ALLOWED_HOSTS is the first step to protecting your app from host header attacks.

2

Foundation

How to Set ALLOWED_HOSTS

Concept: Learn the syntax and examples of setting ALLOWED_HOSTS.

In settings.py, ALLOWED_HOSTS is a Python list of strings. For example: ALLOWED_HOSTS = ['localhost', '127.0.0.1', 'mywebsite.com'] You can add domain names or IP addresses your app should accept.

Result

Django knows which hosts are allowed and which are not.

Knowing the exact format prevents common errors that block legitimate requests.

3

Intermediate

Using Wildcards and Subdomains

🤔Before reading on: do you think ALLOWED_HOSTS supports wildcard entries like '*.example.com'? Commit to your answer.

Concept: Explore how to allow subdomains and wildcards in ALLOWED_HOSTS.

Django does not support wildcards like '*.example.com' directly. To allow subdomains, you must list each explicitly or use a leading dot: ALLOWED_HOSTS = ['.example.com'] This allows example.com and all its subdomains like blog.example.com.

Result

Your app accepts requests from the main domain and all its subdomains.

Knowing the dot prefix trick helps manage multiple subdomains without listing each one.

4

Intermediate

Handling Development vs Production

🤔Before reading on: should ALLOWED_HOSTS be the same in development and production? Commit to your answer.

Concept: Understand different ALLOWED_HOSTS settings for development and production environments.

In development, you often use: ALLOWED_HOSTS = ['localhost', '127.0.0.1'] In production, you replace this with your real domain names. Using '*' (allow all) is unsafe in production but sometimes used in development for convenience.

Result

Your app is secure in production and flexible in development.

Separating environments prevents accidental exposure of your app to unsafe hosts.

5

Advanced

Security Risks of Misconfiguration

🤔Before reading on: do you think setting ALLOWED_HOSTS to ['*'] is safe in production? Commit to your answer.

Concept: Learn why improper ALLOWED_HOSTS settings can lead to security vulnerabilities.

Setting ALLOWED_HOSTS = ['*'] disables host header validation, allowing any host. This can enable host header attacks, cache poisoning, or redirect vulnerabilities. Always specify exact hosts in production.

Result

Your app avoids serious security holes caused by host header spoofing.

Understanding risks guides you to configure ALLOWED_HOSTS correctly and avoid common security mistakes.

6

Expert

Dynamic ALLOWED_HOSTS Configuration

🤔Before reading on: can ALLOWED_HOSTS be set dynamically at runtime? Commit to your answer.

Concept: Explore advanced techniques to set ALLOWED_HOSTS dynamically based on environment or request.

You can set ALLOWED_HOSTS dynamically in settings.py using environment variables or custom logic: import os ALLOWED_HOSTS = os.getenv('DJANGO_ALLOWED_HOSTS', '').split(',') This allows flexible deployment across multiple domains without code changes.

Result

Your app adapts ALLOWED_HOSTS automatically for different deployments.

Dynamic configuration supports complex production setups and continuous deployment workflows.

Under the Hood

When Django receives an HTTP request, it reads the Host header from the request. It then compares this host value against the ALLOWED_HOSTS list. If the host matches any entry (exact or with a leading dot for subdomains), Django proceeds to process the request. Otherwise, it raises a SuspiciousOperation exception, resulting in a 400 Bad Request response. This check happens early in Django's request handling pipeline to prevent further processing of potentially malicious requests.

Why designed this way?

ALLOWED_HOSTS was introduced to prevent HTTP Host header attacks, which can exploit web applications by sending requests with forged Host headers. Before this, Django apps were vulnerable to cache poisoning and redirect attacks. The design uses a whitelist approach because it is safer to explicitly allow known hosts than to try to block bad ones. Alternatives like blacklists were less secure because new malicious hosts could appear anytime.

┌───────────────┐
│ HTTP Request  │
│ Host Header   │
└──────┬────────┘
       │
       ▼
┌───────────────┐
│ Django Server │
│ ALLOWED_HOSTS │
│ Check         │
└──────┬────────┘
       │
  ┌────┴─────┐
  │          │
  ▼          ▼
Process   Reject
Request   Request

Myth Busters - 4 Common Misconceptions

Quick: does setting ALLOWED_HOSTS to ['*'] make your Django app fully secure? Commit to yes or no.

Common Belief: Setting ALLOWED_HOSTS to ['*'] is safe because it allows all hosts and avoids errors.

Reality: Using ['*'] disables host header validation, exposing your app to host header attacks and security risks.

Why it matters: This misconception can lead to serious vulnerabilities, allowing attackers to exploit your app via fake host headers.

Quick: can you use wildcards like '*.example.com' directly in ALLOWED_HOSTS? Commit to yes or no.

Common Belief: You can use wildcard patterns like '*.example.com' in ALLOWED_HOSTS to allow all subdomains.

Reality: Django does not support wildcard patterns; you must use a leading dot '.example.com' to allow subdomains.

Why it matters: Misusing wildcards causes your app to reject valid requests or accept unintended hosts.

Quick: is ALLOWED_HOSTS only important in production? Commit to yes or no.

Common Belief: ALLOWED_HOSTS only matters in production; in development, it can be ignored or set to anything.

Reality: Even in development, incorrect ALLOWED_HOSTS can cause errors or mask configuration issues that appear in production.

Why it matters: Ignoring ALLOWED_HOSTS in development can lead to surprises and bugs when deploying to production.

Quick: does ALLOWED_HOSTS protect against all web security threats? Commit to yes or no.

Common Belief: ALLOWED_HOSTS protects your app from all types of web attacks.

Reality: ALLOWED_HOSTS only protects against host header attacks; other security measures are needed for full protection.

Why it matters: Overestimating ALLOWED_HOSTS can cause neglect of other critical security practices.

Expert Zone

1

ALLOWED_HOSTS matching is case-insensitive, so 'Example.com' and 'example.com' are treated the same.

2

Leading dots in ALLOWED_HOSTS allow subdomains but also include the base domain itself, which can be surprising.

3

When using Django behind proxies or load balancers, you must ensure the Host header is preserved correctly for ALLOWED_HOSTS to work.

When NOT to use

ALLOWED_HOSTS is not a substitute for full web security. For APIs or services behind proxies, consider additional validation layers or middleware. In some microservice architectures, host validation may be handled elsewhere, making ALLOWED_HOSTS less relevant.

Production Patterns

In production, ALLOWED_HOSTS is often set via environment variables or configuration management tools to match the deployment domain. It's common to automate this setting in CI/CD pipelines. For multi-tenant apps, dynamic host validation middleware may complement ALLOWED_HOSTS.

Connections

Cross-Origin Resource Sharing (CORS)

Both control which domains can interact with your app but at different layers; ALLOWED_HOSTS controls HTTP host headers, CORS controls browser resource sharing.

Understanding ALLOWED_HOSTS helps grasp server-side domain trust, which complements client-side domain trust managed by CORS.

Firewall Rules

Both restrict access based on origin; firewalls block IP addresses or ports, ALLOWED_HOSTS restricts HTTP host headers.

Knowing ALLOWED_HOSTS clarifies how application-level filtering complements network-level security.

Access Control Lists (ACLs) in Networking

ALLOWED_HOSTS acts like an ACL for HTTP hosts, allowing only specified entries.

Recognizing ALLOWED_HOSTS as an ACL concept bridges web security with broader network security principles.

Common Pitfalls

#1 Setting ALLOWED_HOSTS to an empty list in production.

Wrong approach:

ALLOWED_HOSTS = []

Correct approach:

ALLOWED_HOSTS = ['yourdomain.com']

Root cause:

Misunderstanding that an empty list blocks all hosts, causing your app to reject all requests.

#2 Using wildcard '*' in production to avoid configuration.

Wrong approach:

ALLOWED_HOSTS = ['*']

Correct approach:

ALLOWED_HOSTS = ['yourdomain.com', '.subdomain.yourdomain.com']

Root cause:

Ignoring security risks of allowing all hosts, leading to vulnerability to host header attacks.

#3 Trying to use '*.example.com' wildcard syntax directly.

Wrong approach:

ALLOWED_HOSTS = ['*.example.com']

Correct approach:

ALLOWED_HOSTS = ['.example.com']

Root cause:

Assuming wildcard patterns work like shell globs, but Django requires a leading dot for subdomains.

Key Takeaways

ALLOWED_HOSTS is a critical Django setting that protects your app by allowing only trusted domain names to serve requests.

Always specify exact domain names or use a leading dot to allow subdomains; wildcards like '*.example.com' are not supported.

Never use ALLOWED_HOSTS = ['*'] in production as it disables important security checks and exposes your app to attacks.

Configure ALLOWED_HOSTS differently for development and production to balance convenience and security.

Understanding ALLOWED_HOSTS helps you build safer Django applications and complements other security measures.

Practice

1. What is the purpose of the ALLOWED_HOSTS setting in a Django project?

easy

A. It sets the database connection details.

B. It specifies which domain names the Django app can serve.

C. It controls the static files location.

D. It defines the middleware order.

Solution

1. Step 1: Understand the role of ALLOWED_HOSTS

   ALLOWED_HOSTS is a security setting that lists domains your Django app accepts requests from.

2. Step 2: Compare with other settings

   Database, static files, and middleware are configured elsewhere, not in ALLOWED_HOSTS.

3. Final Answer:

   It specifies which domain names the Django app can serve. -> Option B

4. Quick Check:

   ALLOWED_HOSTS controls allowed domains = A [OK]

Hint: ALLOWED_HOSTS lists allowed website domains [OK]

Common Mistakes:

• Confusing ALLOWED_HOSTS with database settings
• Thinking it controls static files
• Assuming it manages middleware

2. Which of the following is the correct way to set ALLOWED_HOSTS to allow only example.com and localhost?

easy

A. ALLOWED_HOSTS = ['example.com', 'localhost']

B. ALLOWED_HOSTS = 'example.com, localhost'

C. ALLOWED_HOSTS = {example.com, localhost}

D. ALLOWED_HOSTS = (example.com, localhost)

Solution

1. Step 1: Identify the correct data type for ALLOWED_HOSTS

   ALLOWED_HOSTS must be a list of strings, so square brackets [] are correct.

2. Step 2: Check each option's syntax

   A uses curly braces with unquoted domains (syntax error); B is a string; D uses parentheses with unquoted domains (syntax error). Only C uses a list of quoted strings correctly. Django expects a list.

3. Final Answer:

   ALLOWED_HOSTS = ['example.com', 'localhost'] -> Option A

4. Quick Check:

   ALLOWED_HOSTS is a list = C [OK]

Hint: Use square brackets for ALLOWED_HOSTS list [OK]

Common Mistakes:

• Using a string instead of a list
• Using curly braces without quotes (syntax error)
• Using parentheses without quotes (syntax error)

3. Given this settings.py snippet:

ALLOWED_HOSTS = ['myapp.com', 'localhost']

What happens if a request comes from evil.com?

medium

A. Django will raise a DisallowedHost error.

B. Django will serve the request normally.

C. Django will redirect to localhost.

D. Django will ignore the ALLOWED_HOSTS setting.

Solution

1. Step 1: Understand ALLOWED_HOSTS behavior

   Requests from domains not in ALLOWED_HOSTS cause Django to raise a DisallowedHost exception.

2. Step 2: Apply to the given domain

   Since 'evil.com' is not in ['myapp.com', 'localhost'], Django blocks the request with an error.

3. Final Answer:

   Django will raise a DisallowedHost error. -> Option A

4. Quick Check:

   Unknown domain request = DisallowedHost error [OK]

Hint: Requests from unknown hosts cause DisallowedHost error [OK]

Common Mistakes:

• Assuming Django serves unknown hosts
• Thinking Django redirects unknown hosts
• Ignoring ALLOWED_HOSTS effect

4. Identify the error in this settings.py snippet:

ALLOWED_HOSTS = example.com, localhost

medium

A. ALLOWED_HOSTS should be a dictionary.

B. ALLOWED_HOSTS should be a string, not a list.

C. The list syntax is correct; no error.

D. Missing quotes around domain names.

Solution

1. Step 1: Check syntax for ALLOWED_HOSTS

   ALLOWED_HOSTS must be a list of strings, so domain names need quotes.

2. Step 2: Identify the error in the snippet

   example.com and localhost are unquoted, causing a syntax error or NameError.

3. Final Answer:

   Missing quotes around domain names. -> Option D

4. Quick Check:

   Domain names need quotes = A [OK]

Hint: Always quote domain names in ALLOWED_HOSTS list [OK]

Common Mistakes:

• Forgetting quotes around domains
• Using wrong data types like dict
• Assuming ALLOWED_HOSTS can be a plain string

5. You want your Django app to accept requests from any domain during development but restrict to mydomain.com in production. Which ALLOWED_HOSTS setup is best?

hard

A. Set ALLOWED_HOSTS = ['localhost'] in production.

B. Set ALLOWED_HOSTS = [] in development and ['*'] in production.

C. Set ALLOWED_HOSTS = ['*'] in development and ['mydomain.com'] in production.

D. Set ALLOWED_HOSTS = ['mydomain.com'] always.

Solution

1. Step 1: Understand wildcard usage in development

   Using ['*'] allows all hosts, useful for development to avoid host errors.

2. Step 2: Restrict hosts in production

   For security, production should specify exact domains like ['mydomain.com'] to block unwanted hosts.

3. Final Answer:

   Set ALLOWED_HOSTS = ['*'] in development and ['mydomain.com'] in production. -> Option C

4. Quick Check:

   Wildcard for dev, specific domain for prod = D [OK]

Hint: Use '*' for dev, specific domains for production [OK]

Common Mistakes:

• Using empty list in development causes errors
• Allowing all hosts in production is unsafe
• Setting localhost only in production blocks real users