ALLOWED_HOSTS configuration in Django - Step-by-Step Execution

Concept Flow - ALLOWED_HOSTS configuration

Start Django Server

↓

Receive HTTP Request

↓

Check Host Header

↓

Is Host in ALLOWED_HOSTS?

No→Reject Request with 400

Yes↓

Process Request Normally

↓

Send Response

Django checks the Host header of incoming requests against ALLOWED_HOSTS. If it matches, the request proceeds; otherwise, Django rejects it.

Execution Sample

Django

ALLOWED_HOSTS = ['example.com', 'localhost']

# Incoming request with Host: 'example.com'
# Django checks if 'example.com' is in ALLOWED_HOSTS
# Request allowed and processed

This code shows Django allowing requests only from specified hosts.

Execution Table

Step	Incoming Request Host	Check Host in ALLOWED_HOSTS	Result	Action Taken
1	'example.com'	Yes	Allowed	Process request normally
2	'localhost'	Yes	Allowed	Process request normally
3	'malicious.com'	No	Rejected	Return 400 Bad Request

💡 Requests with hosts not in ALLOWED_HOSTS are rejected to prevent host header attacks.

Variable Tracker

Variable	Start	Request 1	Request 2	Request 3
ALLOWED_HOSTS	['example.com', 'localhost']	['example.com', 'localhost']	['example.com', 'localhost']	['example.com', 'localhost']
Request Host	N/A	'example.com'	'localhost'	'malicious.com'
Host Allowed?	N/A	True	True	False

Key Moments - 2 Insights

Why does Django reject requests with hosts not in ALLOWED_HOSTS?

Django rejects such requests to protect your app from host header attacks, as shown in execution_table row 3 where 'malicious.com' is not allowed.

What happens if ALLOWED_HOSTS is empty?

If ALLOWED_HOSTS is empty, Django rejects all requests except when DEBUG=True, preventing any host from accessing the app.

Visual Quiz - 3 Questions

Look at the execution_table, what action does Django take when the request host is 'localhost'?

A Rejects the request with 400

B Redirects to another host

C Processes the request normally

D Logs an error but processes the request

💡 Hint

Check execution_table row 2 under 'Action Taken'

At which step does Django reject the request due to host not being allowed?

A Step 1

B Step 3

C Step 2

D No rejection occurs

💡 Hint

Look at execution_table row 3 under 'Result' and 'Action Taken'

If you add 'myapp.com' to ALLOWED_HOSTS, what changes in variable_tracker for a request with host 'myapp.com'?

A Host Allowed? becomes True for 'myapp.com'

B Request Host changes to 'example.com'

C ALLOWED_HOSTS becomes empty

D No change occurs

💡 Hint

Refer to variable_tracker row 'Host Allowed?' and how it depends on ALLOWED_HOSTS

Concept Snapshot

ALLOWED_HOSTS is a list of allowed domain names for your Django app.
Django checks incoming request Host headers against this list.
If the host is not in ALLOWED_HOSTS, Django returns a 400 error.
Set ALLOWED_HOSTS to your domain names to protect your app.
Use ['localhost'] for local development.
Empty ALLOWED_HOSTS blocks all hosts unless DEBUG=True.

Full Transcript

In Django, the ALLOWED_HOSTS setting is a list of domain names your app accepts requests from. When a request comes in, Django looks at the Host header and checks if it matches any name in ALLOWED_HOSTS. If it does, Django processes the request normally. If not, Django rejects the request with a 400 Bad Request error to protect your app from attacks. For example, if ALLOWED_HOSTS contains 'example.com' and 'localhost', requests with those hosts are allowed, but a request with 'malicious.com' is rejected. If ALLOWED_HOSTS is empty, Django blocks all hosts unless you are in debug mode. This setting helps keep your app safe by only accepting requests from trusted domains.