How to disable Django's invalid HTTP_HOST error?
Ever since I deployed a site running Django 1.7 alpha (checked out from Git), I've been occasionally receiving error messages with titles like:
"Invalid HTTP_HOST header: 'xxx.xxx.com'"
I realize that this is due to the Host:
HTTP header being set to a hostname not listed in ALLOWED_HOSTS
. However, I have no control over when and how often someone sends a request to the server with a forged hostname. Therefore I do not need a bunch of error emails letting me know that someone else is attempting to do something fishy.
Is there any way to disable this error message? The logging settings for the project look like this:
LOGGING = {
'version': 1,
'disable_existing_loggers': False,
'filters': {
'require_debug_false': {
'()': 'django.utils.log.RequireDebugFalse'
}
},
'handlers': {
'mail_admins': {
'level': 'ERROR',
'filters': ['require_debug_false'],
'class': 'django.utils.log.AdminEmailHandler'
}
},
'loggers': {
'django.request': {
'handlers': ['mail_admins'],
'level': 'ERROR',
'propagate': True,
},
}
}
You shouldn't be ignoring this error. Instead you should be denying the request before it reaches your Django backend. To deny requests with no HOST
set you can use
SetEnvIfNoCase Host .+ VALID_HOST
Order Deny,Allow
Deny from All
Allow from env=VALID_HOST
or force the match to a particular domain (example.com)
SetEnvIfNoCase Host example\.com VALID_HOST
Order Deny,Allow
Deny from All
Allow from env=VALID_HOST
You can add this to the loggers
section of your logging configuration:
'django.security.DisallowedHost': {
'handlers': ['mail_admins'],
'level': 'CRITICAL',
'propagate': False,
},
This sets the logging threshold to above the ERROR
level that Django uses when a SuspiciousOperation
is detected.
Alternatively, you can use e.g. a FileHandler
to log these events without emailing them to you. For example, to use a dedicated file just for these specific events, you could add this to the handlers
section:
'spoof_logfile': {
'level': 'ERROR',
'class': 'logging.FileHandler',
'filename': '/path/to/spoofed_requests.log',
},
and then use this in the loggers
section:
'django.security.DisallowedHost': {
'handlers': ['spoof_logfile'],
'level': 'ERROR',
'propagate': False,
},
Note that the suggestion made in the Django docs, to use
'django.security.DisallowedHost': {
'handlers': ['null'],
'propagate': False,
},
depends on you running Python 2.7 or later - on 2.6, logging
doesn't have a NullHandler
.