django ALLOWED_HOSTS not working

Question

My settings.py file contains:

DEBUG = False
ALLOWED_HOSTS = [u'mydomainxxx.com']

Howevever, I'm able to fire a curl request like this: curl -X GET https://mydomainxxx.com/api/ -H 'Authorization: Token some token' and am getting the response.

I was hoping that using ALLOWED_HOSTS will prevent commands like curl to get response from my API. Is this a normal behaviour ?

You have debug turned on? – dan-klasson Feb 24 '16 at 11:11 — dan-klasson, Feb 24 '16 at 11:11
As mentioned above, it is False – Saurabh Verma Feb 24 '16 at 11:12 — Saurabh Verma, Feb 24 '16 at 11:12

Selcuk · Answer 1 · 2016-02-24T11:24:26.800

6

You are confusing the ALLOWED_HOSTS setting with something else. It denotes the hostnames that your server will listen to; not the hostnames of connecting hosts. There is no built in method to prevent it but you can easily write a middleware to check connecting hostnames.

Your current setting will prevent this from getting a response:

curl -X GET http://another_domainxxx.com/api/ -H 'Authorization: Token some token'

even if both mydomainxxx.com and another_domainxxx.com will resolve to the same IP Address.

edited Feb 24 '16 at 11:24

answered Feb 24 '16 at 11:14

Selcuk

45,843
11
87
90

Thanks Selcuk, can you please point me to a good resource from where I can write this middleware ? – Saurabh Verma Feb 24 '16 at 12:22
1

@SaurabhVerma If you want to restrict by IP address, you can try https://github.com/muccg/django-iprestrict/ or modify it to restrict according to hostname. – Selcuk Feb 24 '16 at 12:29
Thanks, I've added my answer also, which worked for me. – Saurabh Verma Feb 25 '16 at 02:43

Saurabh Verma · Accepted Answer · 2016-02-25T01:38:03.057

Just for anyone who would like to filter on referer url and not on ip address, we can use the following middleware:

from django.conf import settings
from django import http

class AllowHostsMiddleware(object):

    def process_request(self, request):
        referer_url = request.META.get('HTTP_REFERER','')
        if referer_url.startswith(settings.ALLOWED_REFERER_URL):
            return None
        return http.HttpResponseForbidden('<h1>Forbidden</h1>')

django ALLOWED_HOSTS not working

2 Answers2

Linked