Invalid HTTP_HOST, can someone explain why I am getting this?

[frocco]

SuspiciousOperation: Invalid HTTP_HOST header (you may need to set ALLOWED_HOSTS): www.g3suprimentos.com.br

I keep getting this error from time to time.

Is someone trying to hack my site?

Thanks

[Eric Davis]

What is the value of ALLOWED_HOSTS in settings.py?

Your site is serving requests that contain a "Host: www.g3suprimentos.com.br" header. Django doesn't recognize this as an allowed host, hence the error.

https://docs.djangoproject.com/en/1.7/ref/settings/#allowed-hosts has more.

Eric Davis
Email: eda...@eresources.com
Skype: edavis215 

--
You received this message because you are subscribed to the Google Groups "Django users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to django-users...@googlegroups.com.
To post to this group, send email to django...@googlegroups.com.
Visit this group at http://groups.google.com/group/django-users.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/1aa55c70-e51b-44f0-aae6-d1ca3e666467%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[frocco]

I am concerned because I have a value in ALLOWED_HOSTS, but it is not this value.

[Russell Keith-Magee]

Hi,

It's possible that you're getting this error for the exact reason that the check was added - someone is submitting requests to your site with a manipulated HTTP_HOST header. This may not be malicious - it could just be a badly configured robot making web requests.

It might also point at a problem with your hosting provider - especially if you're sharing an IP address with g3suprimentos.com.br, or if g3suprimentos.com.br once had the same IP that you're currently using. 

Without more details, it's hard to say for certain. But is someone trying to hack your site? Almost certainly not. If you were being hacked, you wouldn't have described the problem as "I see this error from time to time" - you would have said "I just received a thousand of these in the last 10 minutes". Attackers aren't noted for their subtlety - they will generally try every possible backdoor and exploit that they know of, all at once. 

Yours,

Russ Magee %-)

--

You received this message because you are subscribed to the Google Groups "Django users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to django-users...@googlegroups.com.
To post to this group, send email to django...@googlegroups.com.
Visit this group at http://groups.google.com/group/django-users.

To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/5550dde0-4230-4068-a8b5-196f0bd844fc%40googlegroups.com.

[frocco]

Thanks for getting back to me.
I am on django 1.5. Is there a setting I can use to avoid getting these emails?
I get at least 5 a week.

[Russell Keith-Magee]

Is there a setting to turn of a warning that someone is attempting to access your site in a potentially malicious way? No.

When you get a warning like this, you investigate the cause, and fix the problem. You don't just silence the warning.

Yours,

Russ Magee %-)

To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/ab908cd5-8c5b-4d6e-9033-80fca60415f7%40googlegroups.com.

[frocco]

The problem is I do not know how to debug this issue.

On Tuesday, March 17, 2015 at 9:17:15 AM UTC-4, frocco wrote:

[Andreas Kuhne]

You are getting it because someone has come to your server by entering www.g3suprimentos.com.br in a browser. If you don't have that address in the allowed hosts setting, you will get the error you have received. 

If you don't want your server to show something for www.g3suprimentos.com.br, then the problem is not on your end, but rather the clients (it can be an incorrect DNS entry, or that someone has edited their hosts file). So you can't do anything to fix it.

Regards,

Andréas

--

You received this message because you are subscribed to the Google Groups "Django users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to django-users...@googlegroups.com.
To post to this group, send email to django...@googlegroups.com.
Visit this group at http://groups.google.com/group/django-users.

To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/e148d1ef-de61-418a-a821-d52dd81e5591%40googlegroups.com.

[François Schiettecatte]

There is nothing to debug, Django is just telling you that it is getting an invalid request where the ‘Host:’ header does not match the host name the application is expecting. Django will reject such requests and warn you about them:

https://docs.djangoproject.com/en/1.8/ref/settings/#allowed-hosts

François

[Carl Meyer]

On 05/15/2015 09:14 AM, Andreas Kuhne wrote:
> You are getting it because someone has come to your server by

> entering www.g3suprimentos.com.br <http://www.g3suprimentos.com.br/> in

> a browser. If you don't have that address in the allowed hosts setting,
> you will get the error you have received.

Correct.

> If you don't want your server to show something

> for www.g3suprimentos.com.br <http://www.g3suprimentos.com.br/>, then

> the problem is not on your end, but rather the clients (it can be an
> incorrect DNS entry, or that someone has edited their hosts file). So
> you can't do anything to fix it.

Not true - in most cases you can fix it on the server side, but the
details depend on your server configuration. You need to configure
whatever front-end server is listening for the web requests to ignore
any requests coming in for a host name that you don't want your server
to respond to. If you're using Apache, this meand making sure that your
Django site is running in a name-based virtualhost (and not the default
one). If you're using nginx, it just means setting the server_name of
the server block to the hostname(s) you actually want to serve. Etc.

Carl

[bobhaugen]

I've gotten this error now and then when I have updated the software on a webfaction-hosted site and restarted Apache. Then it goes away after maybe a couple more restarts. It's like the software has not quite gotten itself together yet. I have no idea why this should be, and since it goes away, I have not opened a ticket on webfaction. 

[Gerald Klein]

This looks like a cross domain request that is being received by your site and the requestor is not listed in your sites allowed sites list, Sites conforming with CORS will have a list of sites that can request data via http from them, this is stating the requestor  is not on the list

Hope that helps

To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/49950182-ac4b-46d8-a277-b265407edfb4%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

Gerald Klein DBA

Cont...@geraldklein.com

www.geraldklein.com

geraldklein.wordpress.com

j...@zognet.com

708-599-0352

Arch, Gentoo I3, Ranger & Vim the coding triple threat.

Linux registered user #548580 

Brought to you by the Amish Mafia

[Carl Meyer]

On May 16, 2015, at 8:12 AM, Gerald Klein <j...@zognet.com> wrote:

This looks like a cross domain request that is being received by your site and the requestor is not listed in your sites allowed sites list, Sites conforming with CORS will have a list of sites that can request data via http from them, this is stating the requestor  is not on the list

No, this is not related to the problem. Django's ALLOWED_HOSTS setting has nothing to do with CORS or the domain the request is coming from, it's about the server's domain(s) and the Host header in the request. 

Carl

To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/CAP8NtCyE9AtLrQ9T%2BN_f8A9CzkAyGgybDU%2BzybzJrcA94uUjPA%40mail.gmail.com.

[frocco]

I am still getting this invalid host from time to time.
Does this mean that someone is trying to hack my site?

www.g3suprimentos.com.br is not anything I own.

For now, I am just ignoring this.

Thanks

[François Schiettecatte]

Not likely, all that is happening is that you are getting requests where the ‘Host:’ HTTP header is not set or set to something other than what is accepted by your site. Most likely a buggy client. I get that all the time, I just ignore it.

Cheers

François

> --
> You received this message because you are subscribed to the Google Groups "Django users" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to django-users...@googlegroups.com.
> To post to this group, send email to django...@googlegroups.com.
> Visit this group at http://groups.google.com/group/django-users.

> To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/a2cac09b-ae37-4b95-a72f-c80c47f24654%40googlegroups.com.

[Carl Meyer]

On 09/21/2015 04:22 PM, François Schiettecatte wrote:
> Not likely, all that is happening is that you are getting requests
> where the ‘Host:’ HTTP header is not set or set to something other
> than what is accepted by your site. Most likely a buggy client. I get
> that all the time, I just ignore it.
>
> Cheers
>
> François
>
>> On Sep 21, 2015, at 6:16 PM, frocco <far...@gmail.com> wrote:
>>
>> I am still getting this invalid host from time to time. Does this
>> mean that someone is trying to hack my site?
>>
>> www.g3suprimentos.com.br is not anything I own.
>>
>> For now, I am just ignoring this.

The best way to solve this for good and never get those errors again is
to fix it in your front-end webserver configuration, so that it ignores
requests for the wrong Host and doesn't even pass them on to Django in
the first place. If you're using nginx that means setting your
`server_name` directive correctly. If you're using Apache that means
using a name-based (non-default) VirtualHost. Any webserver should
provide some way to do this.

Carl

[frocco]

I am using webfaction and django 1.5

Is this something webfaction and resolve?

[frocco]

I spoke with webfaction and they advised I change apache2 config to Listen 127.0.0.1:29627 instead of Listen 29627

[frocco]

Did not solve problem.

They pointed me to this fix.

http://stackoverflow.com/questions/15238506/djangos-suspiciousoperation-invalid-http-host-header/19534738#19534738

Just wanted to share.