# Django可疑操作：无效的HTTP_HOST头

- **ID:** `python/django-suspiciousoperation`
- **领域:** python
- **类别:** config_error
- **验证级别:** ai_generated
- **修复率:** 80%

## 根因

请求中的HTTP_HOST头与ALLOWED_HOSTS设置不匹配。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| 3.x | active | — | — |

## 解决方案

1. **Add valid host to ALLOWED_HOSTS** (95% 成功率)
   ```
   In settings.py: ALLOWED_HOSTS = ['example.com', 'www.example.com']
   ```
2. **Use environment variable for dynamic hosts** (90% 成功率)
   ```
   ALLOWED_HOSTS = os.environ.get('ALLOWED_HOSTS', '').split(',')
   ```

## 无效尝试

- **Setting ALLOWED_HOSTS to ['*']** — Security risk; open to host header attacks. (80% 失败率)
- **Ignoring the error** — Request will be rejected. (90% 失败率)