ALLOWED_HOSTS and Django

Question

I tried to launch a Django 1.11 project on production server. When I start the app I see the following error:

Invalid HTTP_HOST header: 'bla-bla-bla.bla-bla-vla.com'. You may need to add u'bla-bla-bla.bla-bla-vla.com' to ALLOWED_HOSTS**

But, host "bla-bla-bla.bla-bla-vla.com" has been added to ALLOWED_HOSTS in settings.py already!

I tried to switch DEBUG from False to True and back. It works fine, then.

What am I doing wrong?

Answer 1

If Django says:

Invalid HTTP_HOST header: 'bla-bla-bla.bla-bla-vla.com' . You may need to add u' bla-bla-bla.bla-bla-vla.com ' to ALLOWED_HOSTS

then you need to add bla-bla-bla.bla-bla-vla.com , literally (or using a dot as a wildcard) to ALLOWED_HOSTS ( docs ).

Then reload Apache2 (not restart, reload) to verify changes have applied.

Answer 2

As I said in comments :

First option :

You have to write : ALLOWED_HOSTS=["bla-bla.com", "localhost", "127.0.0.1"] in settings.py file

Then, you just have to restart your server with :

sudo reboot

Or easily reload or restart apache2 service

service apache2 reload or service apache2 restart

It should work now ;)

Answer 3

ALLOWED_HOSTS = [
    '127.0.0.1',
    'localhost',
    'bla-bla',
]

Answer 4

Also, if you have a service like gunicorn between your localhost and your nginx server or apache2 server. Remember to restart it too.

sudo systemctl restart gunicorn

Answer 5

I had the same issue make fixed using edit settings.py

ALLOWED_HOSTS = ['127.0.0.1', 'localhost']

Then Run

python manage.py runserver 0.0.0.0:8000

Answer 6

Encountered the same error with NGINX . If one is developing & still testing with port 80 only (no 443 yet) , one may need to temporarily deactivate any strict HTTPS settings right from django settings.py itself. eg comment:

# #### strict https settings
# #### UNCOMMENT at production
# SECURE_REFERRER_POLICY = "same-origin"
# SECURE_BROWSER_XSS_FILTER = True
# SESSION_COOKIE_SECURE = True
# CSRF_COOKIE_SECURE = True
# CSRF_COOKIE_HTTPONLY = True
# SECURE_HSTS_SECONDS = 15780000  
# SECURE_CONTENT_TYPE_NOSNIFF = True
# SECURE_HSTS_INCLUDE_SUBDOMAINS = True
# SECURE_HSTS_PRELOAD = True
# SECURE_SSL_REDIRECT = True
# SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
#
# 
# #PREPEND_WWW = True
# #BASE_URL=["https://www.example.com"]

The error disappears. You can then uncomment back to strict HTTPS settings when the port 443 nginx server block settings are also done.