python config_error ai_generated true

django.core.exceptions.SuspiciousOperation: Invalid HTTP_HOST header

ID: python/django-suspiciousoperation

Also available as: JSON · Markdown · 中文
80%Fix Rate
88%Confidence
0Evidence
2024-06-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
3.x active — — —

Root Cause

The HTTP_HOST header in the request does not match ALLOWED_HOSTS setting.

generic

中文

请求中的HTTP_HOST头与ALLOWED_HOSTS设置不匹配。

Workarounds

  1. 95% success Add valid host to ALLOWED_HOSTS 
    In settings.py: ALLOWED_HOSTS = ['example.com', 'www.example.com']
  2. 90% success Use environment variable for dynamic hosts 
    ALLOWED_HOSTS = os.environ.get('ALLOWED_HOSTS', '').split(',')

Dead Ends

Common approaches that don't work:

  1. Setting ALLOWED_HOSTS to ['*'] 80% fail

    Security risk; open to host header attacks.

  2. Ignoring the error 90% fail

    Request will be rejected.