{"id":484,"date":"2021-12-18T23:44:06","date_gmt":"2021-12-18T23:44:06","guid":{"rendered":"https:\/\/zerotobyte.com\/?p=484"},"modified":"2021-12-20T15:43:32","modified_gmt":"2021-12-20T15:43:32","slug":"use-django-allowed-hosts-to-prevent-security-threats","status":"publish","type":"post","link":"https:\/\/zerotobyte.com\/use-django-allowed-hosts-to-prevent-security-threats\/","title":{"rendered":"Use Django ALLOWED_HOSTS to Prevent Security Threats"},"content":{"rendered":"\n

At some point, you may have come upon the Django ALLOWED_HOSTS<\/code> feature. Correctly configuring this Django setting can prevent many potential security vulnerabilities like HTTP Host header attacks. In this article, I\u2019ll explain why this feature is important, what kind of threats it can prevent and how to properly configure it.<\/p>\n\n\n\n

Django ALLOWED_HOSTS explained<\/h2>\n\n\n\n

ALLOWED_HOSTS<\/code> is a list defined in the project\u2019s settings.py<\/code> file. It contains hostnames or domain names that Django can serve<\/strong>, or in other words, it denotes the hostnames that your server will listen to. Why is this even important?<\/p>\n\n\n\n

To answer this question, we first have to dive into how web servers work and what are the potential risks.<\/p>\n\n\n\n

HTTP Host header<\/h3>\n\n\n\n

Nowadays, it\u2019s common for the same web server to host multiple sites on the same IP address<\/strong>. To route the client request to the correct site, the Host header needs to be defined<\/strong>. If the Host header was not defined, the server would not know to which site it should forward the request. An example HTTP request sent to https:\/\/zerotobyte.com\/about\/<\/code> may look like this:<\/p>\n\n\n\n

GET \/about HTTP\/1.1\nHost: zerotobyte.com<\/pre>\n\n\n\n
NOTE<\/strong> - As of HTTP\/1.1, the HTTP Host header is a mandatory request header.<\/pre>\n\n\n\n
Potential risks of relying on the HTTP Host header<\/h3>\n\n\n\n
Since the Host header is controllable and can be manually set by a client sending the request, this introduces some unwanted security vulnerabilities. By inserting the malicious domain in the Host header, attackers could do harm in many ways. One way of doing it is by defining the X-Forwarded-Host<\/code> header that can overwrite the Host header. An example of an HTTP request sent by the attacker may look like this:<\/p>\n\n\n\n
GET \/about HTTP\/1.1\nHost: zerotobyte.com\nX-Forwarded-Host: attacker.com<\/pre>\n\n\n\n
This type of attack is also commonly known as the HTTP Host header attack<\/strong>, part of a group of HTTP header injection attacks<\/a>. Attackers most commonly use this technique for:<\/p>\n\n\n\n