ALLOWED_HOSTS configuration in Django - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of the ALLOWED_HOSTS setting in Django?

It defines a list of host/domain names that the Django site can serve. This helps protect against HTTP Host header attacks by only allowing requests from specified hosts.

beginner

How do you configure ALLOWED_HOSTS to allow your Django app to serve requests from example.com and www.example.com?

Set ALLOWED_HOSTS = ['example.com', 'www.example.com'] in your settings.py file.

intermediate

What happens if ALLOWED_HOSTS is empty in a production Django app?

Django will raise a DisallowedHost error and refuse to serve requests, because no hosts are allowed. This prevents serving requests from unknown or malicious hosts.

intermediate

Why should you avoid setting ALLOWED_HOSTS = ['*'] in production?

Using '*' allows any host, which removes protection against Host header attacks and can expose your app to security risks.

intermediate

How can you allow localhost and all subdomains of example.com in ALLOWED_HOSTS?

Set ALLOWED_HOSTS = ['localhost', '127.0.0.1', '.example.com']. The dot before example.com allows all subdomains like api.example.com.

What type of values does ALLOWED_HOSTS accept?

A List of strings representing host/domain names

B Boolean values

C Integer port numbers

D File paths

ALLOWED_HOSTS must be a list of strings with host or domain names your app will serve.

What error does Django raise if a request comes from a host not in ALLOWED_HOSTS?

A KeyError

B ValueError

C TypeError

D DisallowedHost

Django raises DisallowedHost to block requests from unauthorized hosts.

Which setting is the safest for ALLOWED_HOSTS in production?

A ['*']

B []

C ['yourdomain.com', 'www.yourdomain.com']

D ['localhost']

Only listing your real domain names protects your app from host header attacks.

How do you allow all subdomains of a domain in ALLOWED_HOSTS?

A Use a leading dot before the domain name

B Use an asterisk (*) anywhere

C Add the domain without any dot

D Use a question mark (?)

A leading dot like '.example.com' allows all subdomains such as 'api.example.com'.

If you want to test locally, which host should you add to ALLOWED_HOSTS?

A 'localhost'

B Both A and C

C '127.0.0.1'

D '0.0.0.0'

Adding both 'localhost' and '127.0.0.1' covers common local testing hosts.

Explain why the ALLOWED_HOSTS setting is important for Django security and how to configure it properly.

Think about what happens if a request comes from an unknown domain.

Describe how to set ALLOWED_HOSTS for a Django app running locally and on a production domain with subdomains.

Consider both local and live environments.