1

Using django, I get the following error showing up in my apache errorlog:

Invalid HTTP_HOST header: 'kyortisdzheykob.ru'. You may need to add u'kyortisdzheykob.ru' to ALLOWED_HOSTS.

But I do not have any mention of this host anywhere in my code. Could someone please explain what is going on here? Should I be worried?

Improve this question

1 Answer 1

Reset to default
2

Assuming that your site is not kyortisdzheykob.ru then somebody is sending a HTTP request to your site where the Host header does not match your site, i.e. trying if your site will answer to a request for http://kyortisdzheykob.ru/ even if your site is actually http://example.com.

A web site should only accept requests for the actually intended domains and should reject any other requests. Failing to do this means that it is vulnerable for attacks like DNS rebinding and depending on the configuration of the site maybe even for more attacks like being used as a proxy to access internal resources.

It looks like that your web server is configured to accept such request which is bad. Fortunately your Django application behind the web server has an additional protection against this misconfiguration in the form of the ALLOWED_HOSTS option and fortunately this options seems to have been set to sane values instead of allowing everything. This means that you don't have to worry for now about the log entry you see: it is only showing that Django successfully blocked a request which was wrong.

But you should better also fix the problem at your web server. How this is exactly done depends on your specific server. But it usually can be done by having virtual hosts for the specific domains the server should be for and then have a default configuration for everything else which simply rejects the request.

Improve this answer
3
  • Okk, so if i understand correctly, in order to remedy the issue, I would need to add a default virtual hosts host, before my virtual host (since they are executed in order and the 1st one is always the fall back) which would match all hosts not in present in the Server <virtual host #2>. Correct me if I am wrong?
    – Lawless Leopard
    Mar 17, 2018 at 12:18
  • 2
    @LawlessLeopard: this probably does the trick for Apache. But you can try yourself by simulating such a request, for example by using wget --header="Host: some.invalid.name" http://example.com/.
    – Steffen Ullrich
    Mar 17, 2018 at 12:28
  • Great thanks for your input, and sorry for the poor formatting. I will definately try that out.
    – Lawless Leopard
    Mar 17, 2018 at 12:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .