Sentry-python: Invalid HTTP_HOST header

[discover59]

I used raven package in Django before and it worked well so far.
Recently I replaced it with latest sentry-python and getting weird error notifications continuously.

Invalid HTTP_HOST header: 'server_ip'. You may need to add 'server_ip' to ALLOWED_HOSTS.

I added server domain, 127.0.0.1 and localhost in allowed hosts.

I think there is no direct request to server IP instead of the domain.

Any help to fix the issue is appreciated.

[untitaker]

Where are you getting that error? In your project or when submitting events from the SDK to Sentry?

[discover59]

Sentry is integrated in my django project and the same event from the project pushed to sentry.
Sometimes it also produces events with example.com and 169.254.169.254 instead of server_ip.

[untitaker]

Could you link me the sentry issue that shows this error?

[discover59]

https://sentry.io/share/issue/8d076660ee2d4009b734d0d594ab0288/

[untitaker]

Yeah this came up a few times before. I think we should just start ignoring that logger, for now you can do:

from sentry.integrations.logging import ignore_logger
ignore_logger("django.security.DisallowedHost")

[discover59]

Thanks.
But I cannot ignore all errors related to DisallowedHost.
I have to track some of those.
Not sure why there are example.com and other strange server ips.

[untitaker]

Because those errors happen. Somebody is sending this as Host header. I am not sure by which criteria you want to filter.

[discover59]

Is it possible to ignore errors with certain host headers in project?
I don't want such invalid errors to fill my sentry event count.

[untitaker]

Yes, you can use the before_send option to look at the event that is about to be sent and return None to throw the event away. I would recommend print(event) in development to figure out which keys to look at for DisallowedHost.

[discover59]

Ok, let me try. Thanks.

[untitaker]

Another option is to use the "message filters" option in the project settings.

[camilonova]

I'm having the same Issue.

@untitaker if i choose the "message filters" it will count at the sentry messages per month?

[untitaker]

@camilonova no, you will not be billed for those events

[discover59]

@camilonova It's better to resolve it on web server such as nginx or apache instead of ignoring such issues.

[camilonova]

This is the nginx configuration that fixes the issue:

server {
    listen                      80 default_server;
    listen                      [::]:80 default_server;

    return                      444;
}

[pixelicous]

@discover59 This seems to me related to services hosted on aws.. i also wasted a couple of hours understanding waht the hell is going on.. for some reason the 444 drop didn't work for me yet, maybe due to the complex config

Below are logs from nginx:
"GET /latest/dynamic/instance-identity/document HTTP/1.1" 400 255 "-" "AWS Security Scanner" "-"

"GET http://example.com/ HTTP/1.1" 301 169 "-" "AWS Security Scanner" "-"

🤦

[untitaker]

"AWS Security Scanner", sounds like AWS employs a bot that is used to figure out if you're accepting random host headers. You're not, because you're using Django.

I wasn't aware of those types of scanners. The initial thought of reporting those types of messages to Sentry was that you'd catch broken configuration that way (requests from your own services with invalid host headers). I guess as long as it's easy enough to filter those events using either before_send or server-side message filters it's alright though.

Let me know your opinions.

[untitaker]

One thing we could do is to add AWS Security Scanners to our list of web crawlers that we offer a filter for: https://docs.sentry.io/accounts/quotas/#inbound-data-filters

[untitaker]

We decided not to swallow those errors but rather filter out false positive errors like AWS Security Scanner. see also https://github.com/getsentry/relay/pull/577

[pixelicous]

@untitaker im not the original issue creator, but thanks for this :)