[Django] #19875: Tutorial should have include ALLOWED

Django

unread,

Feb 21, 2013, 2:34:05 PM2/21/13

to django-...@googlegroups.com

#19875: Tutorial should have include ALLOWED_HOSTS setting
--------------------------------------+------------------------------------
Reporter: anonymous | Owner: nobody
Type: Cleanup/optimization | Status: new
Component: Documentation | Version: 1.4
Severity: Normal | Keywords: ALLOWED_HOSTS,
Triage Stage: Unreviewed | tutorial
Easy pickings: 1 | Has patch: 0
| UI/UX: 0
--------------------------------------+------------------------------------
Got bit by 500 errors when switching to DEBUG=False.

As a total newbie, this was tough because a local install on my mac wasn't
sending me email by default either.

I would recommend updating the tutorial to mention setting ALLOWED_HOSTS
within the initial settings.py setup, perhaps to 127.0.0.1/localhost if
the user is doing a local install.

--
Ticket URL: <https://code.djangoproject.com/ticket/19875>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.

Django

unread,

Feb 21, 2013, 5:36:00 PM2/21/13

to django-...@googlegroups.com

#19875: Tutorial should have include ALLOWED_HOSTS setting

Has patch: 0 | UI/UX: 0

Needs tests: 0 |
Easy pickings: 1 |
-------------------------------------+-------------------------------------
Changes (by carljm):

* needs_better_patch: => 0
* stage: Unreviewed => Accepted
* needs_tests: => 0
* needs_docs: => 0

Comment:

I'm hesitant to add extra verbiage at that stage of the tutorial involving
something that you don't actually need until much later, whenever you try
flipping `DEBUG` to `False`. I was hoping that having `DEBUG` and
`ALLOWED_HOSTS` very close to each other in the template settings file,
and a comment on `ALLOWED_HOSTS` saying "required if DEBUG is False",
would be enough - but apparently it isn't. Maybe we could add another
comment above the `DEBUG` setting in `settings.py` specifically reminding
you to check `ALLOWED_HOSTS` if you flip it to `False`?

Accepting because I think this is a problem that should be solved; not
sure yet if adding to the tutorial is the right solution.

--
Ticket URL: <https://code.djangoproject.com/ticket/19875#comment:1>

Django

unread,

Feb 21, 2013, 7:28:03 PM2/21/13

to django-...@googlegroups.com

#19875: Tutorial should have include ALLOWED_HOSTS setting

-------------------------------------+-------------------------------------
Reporter: anonymous | Owner: nobody

Has patch: 0 | UI/UX: 0

Needs tests: 0 |
Easy pickings: 1 |
-------------------------------------+-------------------------------------

Comment (by russellm):

Agreed that this is a problem that needs to be solved; equally hesitant
about adding it to the early tutorials.

One possible approach would be to tackle an old feature request, and write
a new tutorial on deployment. This would also give us a chance to set some
best practices on "how to do it right", which is something that we've
historically punted on. It's sure to be a bike shed discussion, but with a
couple of judicious BDFL judgements, I'm sure we could get something we
can all live with.

--
Ticket URL: <https://code.djangoproject.com/ticket/19875#comment:2>

Django

unread,

Feb 21, 2013, 7:39:54 PM2/21/13

to django-...@googlegroups.com

#19875: Tutorial should have include ALLOWED_HOSTS setting

-------------------------------------+-------------------------------------
Reporter: anonymous | Owner: nobody

Has patch: 0 | UI/UX: 0

Needs tests: 0 |
Easy pickings: 1 |
-------------------------------------+-------------------------------------

Comment (by carljm):

Is there an existing ticket for "deployment tutorial"? #19697 is at least
closely related.

--
Ticket URL: <https://code.djangoproject.com/ticket/19875#comment:3>

Django

unread,

Mar 29, 2013, 4:24:39 PM3/29/13

to django-...@googlegroups.com

#19875: Tutorial should have include ALLOWED_HOSTS setting

-------------------------------------+-------------------------------------
Reporter: anonymous | Owner: nobody

Has patch: 0 | UI/UX: 0

Needs tests: 0 |
Easy pickings: 1 |
-------------------------------------+-------------------------------------

Comment (by timo):

This was also suggested in #20139.

--
Ticket URL: <https://code.djangoproject.com/ticket/19875#comment:4>

Django

unread,

Apr 2, 2013, 10:38:55 AM4/2/13

to django-...@googlegroups.com

#19875: Tutorial should have include ALLOWED_HOSTS setting

-------------------------------------+-------------------------------------
Reporter: anonymous | Owner: nobody

Has patch: 0 | UI/UX: 0

Needs tests: 0 |
Easy pickings: 1 |
-------------------------------------+-------------------------------------

Comment (by carljm):

#20171 suggests adding documentation under `DEBUG` noting that if you set
it `False` you must set `ALLOWED_HOSTS`. It also contains a list of
related tickets:

* #19866
* #19946
* #20120
* #20139
* #20148
* #20164
* #20171

--
Ticket URL: <https://code.djangoproject.com/ticket/19875#comment:5>

Django

unread,

Apr 10, 2013, 8:47:00 PM4/10/13

to django-...@googlegroups.com

#19875: Tutorial should have include ALLOWED_HOSTS setting

-------------------------------------+-------------------------------------
Reporter: anonymous | Owner: nobody

Has patch: 0 | UI/UX: 0

Needs tests: 0 |
Easy pickings: 1 |
-------------------------------------+-------------------------------------

Comment (by timo):

Suggested again in #20239.

--
Ticket URL: <https://code.djangoproject.com/ticket/19875#comment:6>

Django

unread,

May 31, 2013, 11:09:35 AM5/31/13

to django-...@googlegroups.com

#19875: Tutorial should have include ALLOWED_HOSTS setting

-------------------------------------+-------------------------------------
Reporter: anonymous | Owner: nobody

Has patch: 1 | UI/UX: 0

Needs tests: 0 |
Easy pickings: 1 |
-------------------------------------+-------------------------------------

Changes (by timo):

* cc: timograham@… (added)
* has_patch: 0 => 1

Comment:

Current status of this:

1. The [https://docs.djangoproject.com/en/dev/howto/deployment/checklist/
deployment checklist] has a note about `ALLOWED_HOSTS`.
2. The `ALLOWED_HOSTS` comment in the default project template was removed
(probably in Aymeric's effort to simplify it). I've added it back in the
attached patch as well as other relevant warnings in a couple places.
3. I like the idea offered in #20139: "Whenever starting the server in
`DEBUG = False` and `ALLOWED_HOSTS = []`, display a warning on the console
(stderr) that no request will be served because of the empty
`ALLOWED_HOSTS` setting." If someone agrees, we can open a new ticket.

--
Ticket URL: <https://code.djangoproject.com/ticket/19875#comment:7>

Django

unread,

May 31, 2013, 3:16:16 PM5/31/13

to django-...@googlegroups.com

#19875: Tutorial should have include ALLOWED_HOSTS setting

-------------------------------------+-------------------------------------
Reporter: anonymous | Owner: nobody

Comment (by aaugustin):

AFAIK it's a conscious choice not to talk about anything related to
deployment (like ALLOWED_HOSTS) in the tutorial. The tutorial must stay
focused on its main purpose; it mustn't be a default place for docs that
don't fit anywhere else.

I strongly believe that insufficient information is worse than no
information at all, and for this reason I would really like if we could
keep settings.py as is (although I don't have much hope and I'm pretty
sure settings.py will grow some cruft again; well, at least I'll voice my
opposition).

There's tons of useful advice to give about deployment; the deployment
checklist helps much more than random, piecemeal advice in settings.py. I
have to admit that I don't care very much about users who can't be
bothered to read the docs, too.

--
Ticket URL: <https://code.djangoproject.com/ticket/19875#comment:8>

Django

unread,

May 31, 2013, 4:50:00 PM5/31/13

to django-...@googlegroups.com

#19875: Tutorial should have include ALLOWED_HOSTS setting

-------------------------------------+-------------------------------------
Reporter: anonymous | Owner: nobody

Comment (by timo):

The tutorial talks about setting `DEBUG` to `False` in order to use your
own 404.html, 500.html, etc. templates. The note appears right under that
section so if people try it they will be aware.

I'm fine with keeping settings.py as is.

What do you think about the suggestion of modifying `runserver` so it
won't work with a bad configuration? I feel like that should eliminate
this problem for non-deployment cases.

--
Ticket URL: <https://code.djangoproject.com/ticket/19875#comment:9>

Django

unread,

Jun 4, 2013, 11:29:23 AM6/4/13

to django-...@googlegroups.com

#19875: Tutorial should have include ALLOWED_HOSTS setting

-------------------------------------+-------------------------------------
Reporter: anonymous | Owner: nobody

Comment (by EvilDMP):

I think the console should warn the user, if ALLOWED_HOSTS is empty, that
it will mean the site won't work when DEBUG is False (whatever the current
state of DEBUG).

It's caught me out more than once...

--
Ticket URL: <https://code.djangoproject.com/ticket/19875#comment:10>

Django

unread,

Jun 6, 2013, 8:01:38 AM6/6/13

to django-...@googlegroups.com

#19875: Tutorial should have include ALLOWED_HOSTS setting

-------------------------------------+-------------------------------------
Reporter: anonymous | Owner: nobody

Comment (by timo):

New patch adds logic so `runserver` won't serve any requests if `DEBUG` is
`False` and `ALLOWED_HOSTS` is empty (I'm unsure if this needs tests --
`tests.admin_scripts.ManageRunserver` mocks the `run` method so I don't
think anything in that method is actually tested).

Also removed the note in the previous patch from `settings.py`.

--
Ticket URL: <https://code.djangoproject.com/ticket/19875#comment:11>

Django

unread,

Jun 6, 2013, 11:52:28 AM6/6/13

to django-...@googlegroups.com

#19875: Tutorial should have include ALLOWED_HOSTS setting

-------------------------------------+-------------------------------------
Reporter: anonymous | Owner: nobody

Comment (by claudep):

Small nitpick about `self.stderr.write/exit`, I think that this could be
replaced by raising `CommandError` instead.

--
Ticket URL: <https://code.djangoproject.com/ticket/19875#comment:12>

Django

unread,

Jun 6, 2013, 1:21:34 PM6/6/13

to django-...@googlegroups.com

#19875: Tutorial should have include ALLOWED_HOSTS setting

-------------------------------------+-------------------------------------
Reporter: anonymous | Owner: nobody

Comment (by timo):

Thanks, updated in a pull request. Moved the logic to the `handle()`
method and also added a test. https://github.com/django/django/pull/1249

--
Ticket URL: <https://code.djangoproject.com/ticket/19875#comment:13>

Django

unread,

Jun 9, 2013, 3:06:20 PM6/9/13

to django-...@googlegroups.com

#19875: Tutorial should have include ALLOWED_HOSTS setting

-------------------------------------+-------------------------------------
Reporter: anonymous | Owner: nobody
Type: | Status: closed
Cleanup/optimization | Version: 1.4
Component: Documentation | Resolution: fixed

Changes (by Tim Graham <timograham@…>):

* status: new => closed
* resolution: => fixed

Comment:

In [changeset:"4e94c84e50b960405d5708d8d9528c44c7dabe83"]:
{{{
#!CommitTicketReference repository=""
revision="4e94c84e50b960405d5708d8d9528c44c7dabe83"
Fixed #19875 - Added warnings regarding DEBUG=False and empty
ALLOWED_HOSTS
}}}

--
Ticket URL: <https://code.djangoproject.com/ticket/19875#comment:14>

Django

unread,

Jun 9, 2013, 3:06:46 PM6/9/13

to django-...@googlegroups.com

#19875: Tutorial should have include ALLOWED_HOSTS setting

-------------------------------------+-------------------------------------
Reporter: anonymous | Owner: nobody

Comment (by Tim Graham <timograham@…>):

In [changeset:"46dacb5bb157ff78e21c19f1f1b109edf378ddcb"]:
{{{
#!CommitTicketReference repository=""
revision="46dacb5bb157ff78e21c19f1f1b109edf378ddcb"
[1.5.x] Fixed #19875 - Added warnings regarding DEBUG=False and empty
ALLOWED_HOSTS

Backport of 4e94c84e50 from master
}}}

--
Ticket URL: <https://code.djangoproject.com/ticket/19875#comment:15>

Django

unread,

Jun 9, 2013, 3:09:08 PM6/9/13

to django-...@googlegroups.com

#19875: Tutorial should have include ALLOWED_HOSTS setting

-------------------------------------+-------------------------------------
Reporter: anonymous | Owner: nobody

Comment (by Tim Graham <timograham@…>):

In [changeset:"96c71d423db13825869a929b25d6b83dde67c170"]:
{{{
#!CommitTicketReference repository=""
revision="96c71d423db13825869a929b25d6b83dde67c170"
Added runserver validation to detect if DEBUG=False and ALLOWED_HOSTS is
empty.

[Django] #19875: Tutorial should have include ALLOWED_HOSTS setting

Django

Django

Django

Django

Django

Django

Django

Django

Django

Django

Django

Django

Django

Django

Django

Django

Django