ALLOWED_HOSTS configuration in Django - Step-by-Step Execution

Concept Flow - ALLOWED_HOSTS configuration

Start Django Server

↓

Receive HTTP Request

↓

Check Host Header

↓

Is Host in ALLOWED_HOSTS?

No→Reject Request with 400

Yes↓

Process Request Normally

↓

Send Response

Django checks the Host header of incoming requests against ALLOWED_HOSTS. If it matches, the request proceeds; otherwise, Django rejects it.

Execution Sample

Django

ALLOWED_HOSTS = ['example.com', 'localhost']

# Incoming request with Host: 'example.com'
# Django checks if 'example.com' is in ALLOWED_HOSTS
# Request allowed and processed

This code shows Django allowing requests only from specified hosts.

Execution Table

Step	Incoming Request Host	Check Host in ALLOWED_HOSTS	Result	Action Taken
1	'example.com'	Yes	Allowed	Process request normally
2	'localhost'	Yes	Allowed	Process request normally
3	'malicious.com'	No	Rejected	Return 400 Bad Request

💡 Requests with hosts not in ALLOWED_HOSTS are rejected to prevent host header attacks.

Variable Tracker

Variable	Start	Request 1	Request 2	Request 3
ALLOWED_HOSTS	['example.com', 'localhost']	['example.com', 'localhost']	['example.com', 'localhost']	['example.com', 'localhost']
Request Host	N/A	'example.com'	'localhost'	'malicious.com'
Host Allowed?	N/A	True	True	False

Key Moments - 2 Insights

Why does Django reject requests with hosts not in ALLOWED_HOSTS?

Django rejects such requests to protect your app from host header attacks, as shown in execution_table row 3 where 'malicious.com' is not allowed.

What happens if ALLOWED_HOSTS is empty?

If ALLOWED_HOSTS is empty, Django rejects all requests except when DEBUG=True, preventing any host from accessing the app.

Visual Quiz - 3 Questions

Look at the execution_table, what action does Django take when the request host is 'localhost'?

A Rejects the request with 400

B Redirects to another host

C Processes the request normally

D Logs an error but processes the request

💡 Hint

Check execution_table row 2 under 'Action Taken'

At which step does Django reject the request due to host not being allowed?

A Step 1

B Step 3

C Step 2

D No rejection occurs

💡 Hint

Look at execution_table row 3 under 'Result' and 'Action Taken'

If you add 'myapp.com' to ALLOWED_HOSTS, what changes in variable_tracker for a request with host 'myapp.com'?

A Host Allowed? becomes True for 'myapp.com'

B Request Host changes to 'example.com'

C ALLOWED_HOSTS becomes empty

D No change occurs

💡 Hint

Refer to variable_tracker row 'Host Allowed?' and how it depends on ALLOWED_HOSTS

Concept Snapshot

ALLOWED_HOSTS is a list of allowed domain names for your Django app.
Django checks incoming request Host headers against this list.
If the host is not in ALLOWED_HOSTS, Django returns a 400 error.
Set ALLOWED_HOSTS to your domain names to protect your app.
Use ['localhost'] for local development.
Empty ALLOWED_HOSTS blocks all hosts unless DEBUG=True.

Full Transcript

In Django, the ALLOWED_HOSTS setting is a list of domain names your app accepts requests from. When a request comes in, Django looks at the Host header and checks if it matches any name in ALLOWED_HOSTS. If it does, Django processes the request normally. If not, Django rejects the request with a 400 Bad Request error to protect your app from attacks. For example, if ALLOWED_HOSTS contains 'example.com' and 'localhost', requests with those hosts are allowed, but a request with 'malicious.com' is rejected. If ALLOWED_HOSTS is empty, Django blocks all hosts unless you are in debug mode. This setting helps keep your app safe by only accepting requests from trusted domains.

Practice

1. What is the purpose of the ALLOWED_HOSTS setting in a Django project?

easy

A. It sets the database connection details.

B. It specifies which domain names the Django app can serve.

C. It controls the static files location.

D. It defines the middleware order.

Solution

1. Step 1: Understand the role of ALLOWED_HOSTS

   ALLOWED_HOSTS is a security setting that lists domains your Django app accepts requests from.

2. Step 2: Compare with other settings

   Database, static files, and middleware are configured elsewhere, not in ALLOWED_HOSTS.

3. Final Answer:

   It specifies which domain names the Django app can serve. -> Option B

4. Quick Check:

   ALLOWED_HOSTS controls allowed domains = A [OK]

Hint: ALLOWED_HOSTS lists allowed website domains [OK]

Common Mistakes:

• Confusing ALLOWED_HOSTS with database settings
• Thinking it controls static files
• Assuming it manages middleware

2. Which of the following is the correct way to set ALLOWED_HOSTS to allow only example.com and localhost?

easy

A. ALLOWED_HOSTS = ['example.com', 'localhost']

B. ALLOWED_HOSTS = 'example.com, localhost'

C. ALLOWED_HOSTS = {example.com, localhost}

D. ALLOWED_HOSTS = (example.com, localhost)

Solution

1. Step 1: Identify the correct data type for ALLOWED_HOSTS

   ALLOWED_HOSTS must be a list of strings, so square brackets [] are correct.

2. Step 2: Check each option's syntax

   A uses curly braces with unquoted domains (syntax error); B is a string; D uses parentheses with unquoted domains (syntax error). Only C uses a list of quoted strings correctly. Django expects a list.

3. Final Answer:

   ALLOWED_HOSTS = ['example.com', 'localhost'] -> Option A

4. Quick Check:

   ALLOWED_HOSTS is a list = C [OK]

Hint: Use square brackets for ALLOWED_HOSTS list [OK]

Common Mistakes:

• Using a string instead of a list
• Using curly braces without quotes (syntax error)
• Using parentheses without quotes (syntax error)

3. Given this settings.py snippet:

ALLOWED_HOSTS = ['myapp.com', 'localhost']

What happens if a request comes from evil.com?

medium

A. Django will raise a DisallowedHost error.

B. Django will serve the request normally.

C. Django will redirect to localhost.

D. Django will ignore the ALLOWED_HOSTS setting.

Solution

1. Step 1: Understand ALLOWED_HOSTS behavior

   Requests from domains not in ALLOWED_HOSTS cause Django to raise a DisallowedHost exception.

2. Step 2: Apply to the given domain

   Since 'evil.com' is not in ['myapp.com', 'localhost'], Django blocks the request with an error.

3. Final Answer:

   Django will raise a DisallowedHost error. -> Option A

4. Quick Check:

   Unknown domain request = DisallowedHost error [OK]

Hint: Requests from unknown hosts cause DisallowedHost error [OK]

Common Mistakes:

• Assuming Django serves unknown hosts
• Thinking Django redirects unknown hosts
• Ignoring ALLOWED_HOSTS effect

4. Identify the error in this settings.py snippet:

ALLOWED_HOSTS = example.com, localhost

medium

A. ALLOWED_HOSTS should be a dictionary.

B. ALLOWED_HOSTS should be a string, not a list.

C. The list syntax is correct; no error.

D. Missing quotes around domain names.

Solution

1. Step 1: Check syntax for ALLOWED_HOSTS

   ALLOWED_HOSTS must be a list of strings, so domain names need quotes.

2. Step 2: Identify the error in the snippet

   example.com and localhost are unquoted, causing a syntax error or NameError.

3. Final Answer:

   Missing quotes around domain names. -> Option D

4. Quick Check:

   Domain names need quotes = A [OK]

Hint: Always quote domain names in ALLOWED_HOSTS list [OK]

Common Mistakes:

• Forgetting quotes around domains
• Using wrong data types like dict
• Assuming ALLOWED_HOSTS can be a plain string

5. You want your Django app to accept requests from any domain during development but restrict to mydomain.com in production. Which ALLOWED_HOSTS setup is best?

hard

A. Set ALLOWED_HOSTS = ['localhost'] in production.

B. Set ALLOWED_HOSTS = [] in development and ['*'] in production.

C. Set ALLOWED_HOSTS = ['*'] in development and ['mydomain.com'] in production.

D. Set ALLOWED_HOSTS = ['mydomain.com'] always.

Solution

1. Step 1: Understand wildcard usage in development

   Using ['*'] allows all hosts, useful for development to avoid host errors.

2. Step 2: Restrict hosts in production

   For security, production should specify exact domains like ['mydomain.com'] to block unwanted hosts.

3. Final Answer:

   Set ALLOWED_HOSTS = ['*'] in development and ['mydomain.com'] in production. -> Option C

4. Quick Check:

   Wildcard for dev, specific domain for prod = D [OK]

Hint: Use '*' for dev, specific domains for production [OK]

Common Mistakes:

• Using empty list in development causes errors
• Allowing all hosts in production is unsafe
• Setting localhost only in production blocks real users