ALLOWED_HOSTS and Django

Question

I tried to launch a Django 1.11 project on production server. When I start the app I see the following error:

Invalid HTTP_HOST header: 'bla-bla-bla.bla-bla-vla.com'. You may need to add u'bla-bla-bla.bla-bla-vla.com' to ALLOWED_HOSTS**

But, host "bla-bla-bla.bla-bla-vla.com" has been added to ALLOWED_HOSTS in settings.py already!

I tried to switch DEBUG from False to True and back. It works fine, then.

What am I doing wrong?

Hesperidium

Try this : ALLOWED_HOSTS=["bla-bla.com", "localhost", "127.0.0.1"] in your setting.py file ;) – Linker

Added. No changes. I spent for this mistake about 2 hours already :( – Hesperidium

Could you post your settings ALLOWED_HOSTS part ? – Linker

Yes, please: ALLOWED_HOSTS = ['bla-bla.bla-bla-bla.com', "localhost", "127.0.0.1"] I tried do something like this: ALLOWED_HOSTS = ['*'] and like this: ALLOWED_HOSTS = ['.bla-bla-bla.com'] no changes. I still get the same error... – Hesperidium

Are you using Apache ? – Linker

yes. Apache 2 with Plesk and passenger module – Hesperidium

It seems your domain is bla-bla-bla.bla-bla-vla.com but you've got `bla-bla.bla-bla-bla.com in your ALLOWED_HOSTS (bla-bla.bla-bla-bla.com instead of bla- bla-bla.bla-bla-vla.com) – Cleanthes

This is my orthographic mistake. Sorry – Hesperidium

Answer 1

If Django says:

Invalid HTTP_HOST header: 'bla-bla-bla.bla-bla-vla.com'. You may need to add u'bla-bla-bla.bla-bla-vla.com' to ALLOWED_HOSTS

then you need to add bla-bla-bla.bla-bla-vla.com, literally (or using a dot as a wildcard) to ALLOWED_HOSTS (docs).

Then reload Apache2 (not restart, reload) to verify changes have applied.

Irons

Yep! Apache reloading helps me! Thank you very much! – Hesperidium

Answer 2

As I said in comments :

First option :

You have to write : ALLOWED_HOSTS=["bla-bla.com", "localhost", "127.0.0.1"] in settings.py file

Then, you just have to restart your server with :

sudo reboot

Or easily reload or restart apache2 service

service apache2 reload or service apache2 restart

It should work now ;)

Linker

Unfortunately, this is impossible. Because this is not development server, but production server. So, I can't restart physical machine. – Hesperidium

So make service apache2 restart and it should take account host config – Linker

Answer 3

ALLOWED_HOSTS = [
    '127.0.0.1',
    'localhost',
    'bla-bla',
]

Saltwater

While this code may answer the question, providing additional context regarding how and/or why it solves the problem would improve the answer's long-term value. – Rhett

Answer 4

I had the same issue make fixed using edit settings.py

ALLOWED_HOSTS = ['127.0.0.1', 'localhost']

Then Run

python manage.py runserver 0.0.0.0:8000

Hochheimer

Answer 5

Also, if you have a service like gunicorn between your localhost and your nginx server or apache2 server. Remember to restart it too.

sudo systemctl restart gunicorn

Prickly

Answer 6

Encountered the same error with NGINX. If one is developing & still testing with port 80 only (no 443 yet), one may need to temporarily deactivate any strict HTTPS settings right from django settings.py itself. e.g comment:

# #### strict https settings
# #### UNCOMMENT at production
# SECURE_REFERRER_POLICY = "same-origin"
# SECURE_BROWSER_XSS_FILTER = True
# SESSION_COOKIE_SECURE = True
# CSRF_COOKIE_SECURE = True
# CSRF_COOKIE_HTTPONLY = True
# SECURE_HSTS_SECONDS = 15780000  
# SECURE_CONTENT_TYPE_NOSNIFF = True
# SECURE_HSTS_INCLUDE_SUBDOMAINS = True
# SECURE_HSTS_PRELOAD = True
# SECURE_SSL_REDIRECT = True
# SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
#
# 
# #PREPEND_WWW = True
# #BASE_URL=["https://www.example.com"]

The error disappears. You can then uncomment back to strict HTTPS settings when the port 443 nginx server block settings are also done.

Prickly