ALLOWED_HOSTS configuration in Django - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to allow all hosts in Django settings.

Django

ALLOWED_HOSTS = [[1]]

Drag options to blanks, or click blank then click option'

A"*"

B"localhost"

C"127.0.0.1"

D"example.com"

Attempts:

3 left

💡 Hint

Common Mistakes

Using a single hostname like 'localhost' limits access to that host only.

Leaving ALLOWED_HOSTS empty causes Django to reject all requests.

Using "*" in ALLOWED_HOSTS allows Django to accept requests from any host.

2fill in blank

medium

Complete the code to allow only localhost and example.com hosts.

Django

ALLOWED_HOSTS = [[1]]

Drag options to blanks, or click blank then click option'

A"example.org"

B"*"

C"127.0.0.1"

D"localhost", "example.com"

Attempts:

3 left

💡 Hint

Common Mistakes

Using a single string without commas causes a syntax error.

Using '*' allows all hosts, which is not restrictive.

Listing hostnames as strings in ALLOWED_HOSTS restricts access to those hosts only.

3fill in blank

hard

Fix the error in ALLOWED_HOSTS to allow only 127.0.0.1.

Django

ALLOWED_HOSTS = [1]

Drag options to blanks, or click blank then click option'

A["127.0.0.1"]

B"127.0.0.1"

C127.0.0.1

D['127.0.0.1']

Attempts:

3 left

💡 Hint

Common Mistakes

Using a plain string without list brackets causes errors.

Using unquoted IP address is invalid syntax.

ALLOWED_HOSTS must be a list of strings. Using ["127.0.0.1"] is correct syntax.

4fill in blank

hard

Fill both blanks to allow localhost and a custom domain in ALLOWED_HOSTS.

Django

ALLOWED_HOSTS = [[1], [2]]

Drag options to blanks, or click blank then click option'

A"localhost"

B"example.com"

C"127.0.0.1"

D"mydomain.org"

Attempts:

3 left

💡 Hint

Common Mistakes

Using IP address and hostname inconsistently.

Forgetting quotes around hostnames.

ALLOWED_HOSTS list includes all allowed hostnames as strings.

5fill in blank

hard

Fill all three blanks to allow localhost, 127.0.0.1, and a custom domain.

Django

ALLOWED_HOSTS = [[1], [2], [3]]

Drag options to blanks, or click blank then click option'

A"localhost"

B"127.0.0.1"

C"customdomain.com"

D"example.org"

Attempts:

3 left

💡 Hint

Common Mistakes

Leaving out quotes around hostnames or IP addresses.

Using incorrect domain names not intended to be allowed.

ALLOWED_HOSTS list should include all allowed hosts as strings in a list.

Practice

1. What is the purpose of the ALLOWED_HOSTS setting in a Django project?

easy

A. It sets the database connection details.

B. It specifies which domain names the Django app can serve.

C. It controls the static files location.

D. It defines the middleware order.

Solution

1. Step 1: Understand the role of ALLOWED_HOSTS

   ALLOWED_HOSTS is a security setting that lists domains your Django app accepts requests from.

2. Step 2: Compare with other settings

   Database, static files, and middleware are configured elsewhere, not in ALLOWED_HOSTS.

3. Final Answer:

   It specifies which domain names the Django app can serve. -> Option B

4. Quick Check:

   ALLOWED_HOSTS controls allowed domains = A [OK]

Hint: ALLOWED_HOSTS lists allowed website domains [OK]

Common Mistakes:

• Confusing ALLOWED_HOSTS with database settings
• Thinking it controls static files
• Assuming it manages middleware

2. Which of the following is the correct way to set ALLOWED_HOSTS to allow only example.com and localhost?

easy

A. ALLOWED_HOSTS = ['example.com', 'localhost']

B. ALLOWED_HOSTS = 'example.com, localhost'

C. ALLOWED_HOSTS = {example.com, localhost}

D. ALLOWED_HOSTS = (example.com, localhost)

Solution

1. Step 1: Identify the correct data type for ALLOWED_HOSTS

   ALLOWED_HOSTS must be a list of strings, so square brackets [] are correct.

2. Step 2: Check each option's syntax

   A uses curly braces with unquoted domains (syntax error); B is a string; D uses parentheses with unquoted domains (syntax error). Only C uses a list of quoted strings correctly. Django expects a list.

3. Final Answer:

   ALLOWED_HOSTS = ['example.com', 'localhost'] -> Option A

4. Quick Check:

   ALLOWED_HOSTS is a list = C [OK]

Hint: Use square brackets for ALLOWED_HOSTS list [OK]

Common Mistakes:

• Using a string instead of a list
• Using curly braces without quotes (syntax error)
• Using parentheses without quotes (syntax error)

3. Given this settings.py snippet:

ALLOWED_HOSTS = ['myapp.com', 'localhost']

What happens if a request comes from evil.com?

medium

A. Django will raise a DisallowedHost error.

B. Django will serve the request normally.

C. Django will redirect to localhost.

D. Django will ignore the ALLOWED_HOSTS setting.

Solution

1. Step 1: Understand ALLOWED_HOSTS behavior

   Requests from domains not in ALLOWED_HOSTS cause Django to raise a DisallowedHost exception.

2. Step 2: Apply to the given domain

   Since 'evil.com' is not in ['myapp.com', 'localhost'], Django blocks the request with an error.

3. Final Answer:

   Django will raise a DisallowedHost error. -> Option A

4. Quick Check:

   Unknown domain request = DisallowedHost error [OK]

Hint: Requests from unknown hosts cause DisallowedHost error [OK]

Common Mistakes:

• Assuming Django serves unknown hosts
• Thinking Django redirects unknown hosts
• Ignoring ALLOWED_HOSTS effect

4. Identify the error in this settings.py snippet:

ALLOWED_HOSTS = example.com, localhost

medium

A. ALLOWED_HOSTS should be a dictionary.

B. ALLOWED_HOSTS should be a string, not a list.

C. The list syntax is correct; no error.

D. Missing quotes around domain names.

Solution

1. Step 1: Check syntax for ALLOWED_HOSTS

   ALLOWED_HOSTS must be a list of strings, so domain names need quotes.

2. Step 2: Identify the error in the snippet

   example.com and localhost are unquoted, causing a syntax error or NameError.

3. Final Answer:

   Missing quotes around domain names. -> Option D

4. Quick Check:

   Domain names need quotes = A [OK]

Hint: Always quote domain names in ALLOWED_HOSTS list [OK]

Common Mistakes:

• Forgetting quotes around domains
• Using wrong data types like dict
• Assuming ALLOWED_HOSTS can be a plain string

5. You want your Django app to accept requests from any domain during development but restrict to mydomain.com in production. Which ALLOWED_HOSTS setup is best?

hard

A. Set ALLOWED_HOSTS = ['localhost'] in production.

B. Set ALLOWED_HOSTS = [] in development and ['*'] in production.

C. Set ALLOWED_HOSTS = ['*'] in development and ['mydomain.com'] in production.

D. Set ALLOWED_HOSTS = ['mydomain.com'] always.

Solution

1. Step 1: Understand wildcard usage in development

   Using ['*'] allows all hosts, useful for development to avoid host errors.

2. Step 2: Restrict hosts in production

   For security, production should specify exact domains like ['mydomain.com'] to block unwanted hosts.

3. Final Answer:

   Set ALLOWED_HOSTS = ['*'] in development and ['mydomain.com'] in production. -> Option C

4. Quick Check:

   Wildcard for dev, specific domain for prod = D [OK]

Hint: Use '*' for dev, specific domains for production [OK]

Common Mistakes:

• Using empty list in development causes errors
• Allowing all hosts in production is unsafe
• Setting localhost only in production blocks real users