ALLOWED_HOSTS configuration in Django - Mini Project: Build & Apply

ALLOWED_HOSTS Configuration in Django

📖 Scenario: You are setting up a Django web application that will be accessed from specific domain names. To keep your app secure, you need to configure which hosts are allowed to serve your site.

🎯 Goal: Configure the ALLOWED_HOSTS setting in Django's settings.py file to specify the exact domain names your app will respond to.

📋 What You'll Learn

Create a list variable named ALLOWED_HOSTS in settings.py

Include the exact hostnames 'localhost' and 'example.com' in the list

Add a variable debug_mode set to False to simulate production environment

Use a conditional statement to include a warning comment if debug_mode is False and ALLOWED_HOSTS is empty

💡 Why This Matters

🌍 Real World

Web developers must configure ALLOWED_HOSTS in Django to prevent HTTP Host header attacks and ensure the app only responds to trusted domains.

💼 Career

Understanding ALLOWED_HOSTS is essential for Django developers to deploy secure and reliable web applications in production.

1

Create the ALLOWED_HOSTS list

In settings.py, create a list variable called ALLOWED_HOSTS with the exact values 'localhost' and 'example.com'.

Django

# Your code here

Hint

Remember, ALLOWED_HOSTS is a list of strings.

2

Add a debug_mode variable

Below the ALLOWED_HOSTS list, create a variable called debug_mode and set it to False.

Django

ALLOWED_HOSTS = ['localhost', 'example.com']
# Your code here

Hint

This variable simulates whether the app is in debug mode or production.

3

Check ALLOWED_HOSTS when debug_mode is false

Write an if statement that checks if debug_mode is False and ALLOWED_HOSTS is empty. Inside the if, write a comment saying # Warning: ALLOWED_HOSTS is empty in production.

Django

ALLOWED_HOSTS = ['localhost', 'example.com']
debug_mode = False
# Your code here

Hint

Use and to combine conditions in the if statement.

4

Add localhost to ALLOWED_HOSTS if empty in production

Add an else block after the if statement. Inside the else, append 'localhost' to the ALLOWED_HOSTS list.

Django

ALLOWED_HOSTS = ['localhost', 'example.com']
debug_mode = False
if debug_mode == False and ALLOWED_HOSTS == []:
    # Warning: ALLOWED_HOSTS is empty in production
# Your code here

Hint

The append() method adds an item to the end of a list.

Practice

1. What is the purpose of the ALLOWED_HOSTS setting in a Django project?

easy

A. It sets the database connection details.

B. It specifies which domain names the Django app can serve.

C. It controls the static files location.

D. It defines the middleware order.

Solution

1. Step 1: Understand the role of ALLOWED_HOSTS

   ALLOWED_HOSTS is a security setting that lists domains your Django app accepts requests from.

2. Step 2: Compare with other settings

   Database, static files, and middleware are configured elsewhere, not in ALLOWED_HOSTS.

3. Final Answer:

   It specifies which domain names the Django app can serve. -> Option B

4. Quick Check:

   ALLOWED_HOSTS controls allowed domains = A [OK]

Hint: ALLOWED_HOSTS lists allowed website domains [OK]

Common Mistakes:

• Confusing ALLOWED_HOSTS with database settings
• Thinking it controls static files
• Assuming it manages middleware

2. Which of the following is the correct way to set ALLOWED_HOSTS to allow only example.com and localhost?

easy

A. ALLOWED_HOSTS = ['example.com', 'localhost']

B. ALLOWED_HOSTS = 'example.com, localhost'

C. ALLOWED_HOSTS = {example.com, localhost}

D. ALLOWED_HOSTS = (example.com, localhost)

Solution

1. Step 1: Identify the correct data type for ALLOWED_HOSTS

   ALLOWED_HOSTS must be a list of strings, so square brackets [] are correct.

2. Step 2: Check each option's syntax

   A uses curly braces with unquoted domains (syntax error); B is a string; D uses parentheses with unquoted domains (syntax error). Only C uses a list of quoted strings correctly. Django expects a list.

3. Final Answer:

   ALLOWED_HOSTS = ['example.com', 'localhost'] -> Option A

4. Quick Check:

   ALLOWED_HOSTS is a list = C [OK]

Hint: Use square brackets for ALLOWED_HOSTS list [OK]

Common Mistakes:

• Using a string instead of a list
• Using curly braces without quotes (syntax error)
• Using parentheses without quotes (syntax error)

3. Given this settings.py snippet:

ALLOWED_HOSTS = ['myapp.com', 'localhost']

What happens if a request comes from evil.com?

medium

A. Django will raise a DisallowedHost error.

B. Django will serve the request normally.

C. Django will redirect to localhost.

D. Django will ignore the ALLOWED_HOSTS setting.

Solution

1. Step 1: Understand ALLOWED_HOSTS behavior

   Requests from domains not in ALLOWED_HOSTS cause Django to raise a DisallowedHost exception.

2. Step 2: Apply to the given domain

   Since 'evil.com' is not in ['myapp.com', 'localhost'], Django blocks the request with an error.

3. Final Answer:

   Django will raise a DisallowedHost error. -> Option A

4. Quick Check:

   Unknown domain request = DisallowedHost error [OK]

Hint: Requests from unknown hosts cause DisallowedHost error [OK]

Common Mistakes:

• Assuming Django serves unknown hosts
• Thinking Django redirects unknown hosts
• Ignoring ALLOWED_HOSTS effect

4. Identify the error in this settings.py snippet:

ALLOWED_HOSTS = example.com, localhost

medium

A. ALLOWED_HOSTS should be a dictionary.

B. ALLOWED_HOSTS should be a string, not a list.

C. The list syntax is correct; no error.

D. Missing quotes around domain names.

Solution

1. Step 1: Check syntax for ALLOWED_HOSTS

   ALLOWED_HOSTS must be a list of strings, so domain names need quotes.

2. Step 2: Identify the error in the snippet

   example.com and localhost are unquoted, causing a syntax error or NameError.

3. Final Answer:

   Missing quotes around domain names. -> Option D

4. Quick Check:

   Domain names need quotes = A [OK]

Hint: Always quote domain names in ALLOWED_HOSTS list [OK]

Common Mistakes:

• Forgetting quotes around domains
• Using wrong data types like dict
• Assuming ALLOWED_HOSTS can be a plain string

5. You want your Django app to accept requests from any domain during development but restrict to mydomain.com in production. Which ALLOWED_HOSTS setup is best?

hard

A. Set ALLOWED_HOSTS = ['localhost'] in production.

B. Set ALLOWED_HOSTS = [] in development and ['*'] in production.

C. Set ALLOWED_HOSTS = ['*'] in development and ['mydomain.com'] in production.

D. Set ALLOWED_HOSTS = ['mydomain.com'] always.

Solution

1. Step 1: Understand wildcard usage in development

   Using ['*'] allows all hosts, useful for development to avoid host errors.

2. Step 2: Restrict hosts in production

   For security, production should specify exact domains like ['mydomain.com'] to block unwanted hosts.

3. Final Answer:

   Set ALLOWED_HOSTS = ['*'] in development and ['mydomain.com'] in production. -> Option C

4. Quick Check:

   Wildcard for dev, specific domain for prod = D [OK]

Hint: Use '*' for dev, specific domains for production [OK]

Common Mistakes:

• Using empty list in development causes errors
• Allowing all hosts in production is unsafe
• Setting localhost only in production blocks real users