Cookiecutter-django: Invalid HTTP_HOST header: <ip>. You may need to add <ip> to ALLOWED_HOSTS.

[piyushmaurya23]

here are details:

1. Deployed on production using docker.
2. address is in DJANGO_ALLOWED_HOSTS in production .env
3. Getting error even after adding to allowed_host.

[Afrowave]

Did you build and upload the .env to production? That should sort it out.

[piyushmaurya23]

@Afrowave I have did that and still getting this error.

[Afrowave]

Do you have any spaces before or after the IP addresses?

[piyushmaurya23]

@Afrowave No, there is no any space before and after IP addresses.

[Sgiath]

Try to hardcode * into allowed hosts in settings (ALLOWED_HOSTS = ['*']). If you still getting this error problem is somewhere else. If it fixed it try to add * to .env file and load this value into settings. If it doesn't work there is a problem with reading your .env file. If it still works try to hardcode your IP into settings and access your app via IP. If it works add your IP to the .env. Then try hardcode your HOST into settings and see what happens... and so on.

When you finish then you will have more info about the problem and what is the root cause and maybe you will be able to fix it. Or provide this information to us and we will be able to help you better.

[pydanny]

@Sgiath, the help is appreciated, but you don't need to close it with an annoyed sounding comment.

[pydanny]

@piyushmaurya23, if you do set ALLOWED_HOSTS = ['*'], for the love of God, don't leave it as such once you get this figured out. The reason is that makes Django potentially vulnerable to HTTP_HOST header attacks. And automated scripts scour the internet to check if sites have this vulnerability.

I know this because some of my production sites are hit 20-50 times a day by these scripted vulnerability checks.

[Sgiath]

@pydanny sorry I didn't want to offend someone ;)

[luzfcb]

django 1.10.3 Changed the behavior and now make some additional validations on ALLOWED_HOSTS

https://docs.djangoproject.com/en/1.10/releases/1.10.3/#dns-rebinding-vulnerability-when-debug-true

[piyushmaurya23]

Hardcoded ALLOWED_HOST=['ip_address'] in setting, it worked. Trying to figure out problem.

Thank you @pydanny @Sgiath @luzfcb

[Afrowave]

@piyushmaurya23 When using Docker for development, I found that if you choose a vm with a static IP, you will have to add the IP address to a ALLOWED_HOSTS to the config/settings/local.py file.

For production, I used the .env file.

[Adoniswalker]

Where is this .env located?

[sfdye]

@Adoniswalker You have to create the .env yourself and it should NOT be checked into version control. There is a env.example in the project to get you started.

[Adoniswalker]

I twicked it and it got solved i dont know how, i just removed 127.0.0.1 from the list

[peterkuria]

Sometimes the issue is caused by running the server on production configs on your dev. I managed to switch it and use development and solved: Bad Request(400) error: on .django and .env change DJANGO_SETTINGS_MODULE=config.settings.production for dev purpose to:

DJANGO_SETTINGS_MODULE=config.settings.local

[muloh]

Had the same error but found just a perfect fix for that here https://www.wemakeitclear.com/en/blog/blog_details/25/invalide-http_host-header

[muloh]

Sometimes the issue is caused by running the server on production configs on your dev. I managed to switch it and use development and solved: Bad Request(400) error: on .django and .env change DJANGO_SETTINGS_MODULE=config.settings.production for dev purpose to:

DJANGO_SETTINGS_MODULE=config.settings.local

solved my problem here https://www.wemakeitclear.com/en/blog/blog_details/25/invalide-http_host-header