ALLOWED_HOSTS configuration in Django - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of the ALLOWED_HOSTS setting in Django?

It defines a list of host/domain names that the Django site can serve. This helps protect against HTTP Host header attacks by only allowing requests from specified hosts.

beginner

How do you configure ALLOWED_HOSTS to allow your Django app to serve requests from example.com and www.example.com?

Set ALLOWED_HOSTS = ['example.com', 'www.example.com'] in your settings.py file.

intermediate

What happens if ALLOWED_HOSTS is empty in a production Django app?

Django will raise a DisallowedHost error and refuse to serve requests, because no hosts are allowed. This prevents serving requests from unknown or malicious hosts.

intermediate

Why should you avoid setting ALLOWED_HOSTS = ['*'] in production?

Using '*' allows any host, which removes protection against Host header attacks and can expose your app to security risks.

intermediate

How can you allow localhost and all subdomains of example.com in ALLOWED_HOSTS?

Set ALLOWED_HOSTS = ['localhost', '127.0.0.1', '.example.com']. The dot before example.com allows all subdomains like api.example.com.

What type of values does ALLOWED_HOSTS accept?

A List of strings representing host/domain names

B Boolean values

C Integer port numbers

D File paths

ALLOWED_HOSTS must be a list of strings with host or domain names your app will serve.

What error does Django raise if a request comes from a host not in ALLOWED_HOSTS?

A KeyError

B ValueError

C TypeError

D DisallowedHost

Django raises DisallowedHost to block requests from unauthorized hosts.

Which setting is the safest for ALLOWED_HOSTS in production?

A ['*']

B []

C ['yourdomain.com', 'www.yourdomain.com']

D ['localhost']

Only listing your real domain names protects your app from host header attacks.

How do you allow all subdomains of a domain in ALLOWED_HOSTS?

A Use a leading dot before the domain name

B Use an asterisk (*) anywhere

C Add the domain without any dot

D Use a question mark (?)

A leading dot like '.example.com' allows all subdomains such as 'api.example.com'.

If you want to test locally, which host should you add to ALLOWED_HOSTS?

A 'localhost'

B Both A and C

C '127.0.0.1'

D '0.0.0.0'

Adding both 'localhost' and '127.0.0.1' covers common local testing hosts.

Explain why the ALLOWED_HOSTS setting is important for Django security and how to configure it properly.

Think about what happens if a request comes from an unknown domain.

Describe how to set ALLOWED_HOSTS for a Django app running locally and on a production domain with subdomains.

Consider both local and live environments.

Practice

1. What is the purpose of the ALLOWED_HOSTS setting in a Django project?

easy

A. It sets the database connection details.

B. It specifies which domain names the Django app can serve.

C. It controls the static files location.

D. It defines the middleware order.

Solution

1. Step 1: Understand the role of ALLOWED_HOSTS

   ALLOWED_HOSTS is a security setting that lists domains your Django app accepts requests from.

2. Step 2: Compare with other settings

   Database, static files, and middleware are configured elsewhere, not in ALLOWED_HOSTS.

3. Final Answer:

   It specifies which domain names the Django app can serve. -> Option B

4. Quick Check:

   ALLOWED_HOSTS controls allowed domains = A [OK]

Hint: ALLOWED_HOSTS lists allowed website domains [OK]

Common Mistakes:

• Confusing ALLOWED_HOSTS with database settings
• Thinking it controls static files
• Assuming it manages middleware

2. Which of the following is the correct way to set ALLOWED_HOSTS to allow only example.com and localhost?

easy

A. ALLOWED_HOSTS = ['example.com', 'localhost']

B. ALLOWED_HOSTS = 'example.com, localhost'

C. ALLOWED_HOSTS = {example.com, localhost}

D. ALLOWED_HOSTS = (example.com, localhost)

Solution

1. Step 1: Identify the correct data type for ALLOWED_HOSTS

   ALLOWED_HOSTS must be a list of strings, so square brackets [] are correct.

2. Step 2: Check each option's syntax

   A uses curly braces with unquoted domains (syntax error); B is a string; D uses parentheses with unquoted domains (syntax error). Only C uses a list of quoted strings correctly. Django expects a list.

3. Final Answer:

   ALLOWED_HOSTS = ['example.com', 'localhost'] -> Option A

4. Quick Check:

   ALLOWED_HOSTS is a list = C [OK]

Hint: Use square brackets for ALLOWED_HOSTS list [OK]

Common Mistakes:

• Using a string instead of a list
• Using curly braces without quotes (syntax error)
• Using parentheses without quotes (syntax error)

3. Given this settings.py snippet:

ALLOWED_HOSTS = ['myapp.com', 'localhost']

What happens if a request comes from evil.com?

medium

A. Django will raise a DisallowedHost error.

B. Django will serve the request normally.

C. Django will redirect to localhost.

D. Django will ignore the ALLOWED_HOSTS setting.

Solution

1. Step 1: Understand ALLOWED_HOSTS behavior

   Requests from domains not in ALLOWED_HOSTS cause Django to raise a DisallowedHost exception.

2. Step 2: Apply to the given domain

   Since 'evil.com' is not in ['myapp.com', 'localhost'], Django blocks the request with an error.

3. Final Answer:

   Django will raise a DisallowedHost error. -> Option A

4. Quick Check:

   Unknown domain request = DisallowedHost error [OK]

Hint: Requests from unknown hosts cause DisallowedHost error [OK]

Common Mistakes:

• Assuming Django serves unknown hosts
• Thinking Django redirects unknown hosts
• Ignoring ALLOWED_HOSTS effect

4. Identify the error in this settings.py snippet:

ALLOWED_HOSTS = example.com, localhost

medium

A. ALLOWED_HOSTS should be a dictionary.

B. ALLOWED_HOSTS should be a string, not a list.

C. The list syntax is correct; no error.

D. Missing quotes around domain names.

Solution

1. Step 1: Check syntax for ALLOWED_HOSTS

   ALLOWED_HOSTS must be a list of strings, so domain names need quotes.

2. Step 2: Identify the error in the snippet

   example.com and localhost are unquoted, causing a syntax error or NameError.

3. Final Answer:

   Missing quotes around domain names. -> Option D

4. Quick Check:

   Domain names need quotes = A [OK]

Hint: Always quote domain names in ALLOWED_HOSTS list [OK]

Common Mistakes:

• Forgetting quotes around domains
• Using wrong data types like dict
• Assuming ALLOWED_HOSTS can be a plain string

5. You want your Django app to accept requests from any domain during development but restrict to mydomain.com in production. Which ALLOWED_HOSTS setup is best?

hard

A. Set ALLOWED_HOSTS = ['localhost'] in production.

B. Set ALLOWED_HOSTS = [] in development and ['*'] in production.

C. Set ALLOWED_HOSTS = ['*'] in development and ['mydomain.com'] in production.

D. Set ALLOWED_HOSTS = ['mydomain.com'] always.

Solution

1. Step 1: Understand wildcard usage in development

   Using ['*'] allows all hosts, useful for development to avoid host errors.

2. Step 2: Restrict hosts in production

   For security, production should specify exact domains like ['mydomain.com'] to block unwanted hosts.

3. Final Answer:

   Set ALLOWED_HOSTS = ['*'] in development and ['mydomain.com'] in production. -> Option C

4. Quick Check:

   Wildcard for dev, specific domain for prod = D [OK]

Hint: Use '*' for dev, specific domains for production [OK]

Common Mistakes:

• Using empty list in development causes errors
• Allowing all hosts in production is unsafe
• Setting localhost only in production blocks real users