python config_error ai_generated true

Django可疑操作：无效的HTTP_HOST头

django.core.exceptions.SuspiciousOperation: Invalid HTTP_HOST header

ID: python/django-suspiciousoperation

其他格式: JSON · Markdown 中文 · English
80%修复率
88%置信度
0证据数
2024-06-01首次发现

版本兼容性

版本状态引入弃用备注
3.x active — — —

根因分析

请求中的HTTP_HOST头与ALLOWED_HOSTS设置不匹配。

English

The HTTP_HOST header in the request does not match ALLOWED_HOSTS setting.

generic

解决方案

  1. 95% 成功率 Add valid host to ALLOWED_HOSTS 
    In settings.py: ALLOWED_HOSTS = ['example.com', 'www.example.com']
  2. 90% 成功率 Use environment variable for dynamic hosts 
    ALLOWED_HOSTS = os.environ.get('ALLOWED_HOSTS', '').split(',')

无效尝试

常见但无效的做法:

  1. Setting ALLOWED_HOSTS to ['*'] 80% 失败

    Security risk; open to host header attacks.

  2. Ignoring the error 90% 失败

    Request will be rejected.