# Dissallowed host error

**URL:** <https://forum.djangoproject.com/t/dissallowed-host-error/29063>\
**Category:** Mystery Errors\
**Created:** [March 14, 2024, 10:14am UTC](https://forum.djangoproject.com/t/dissallowed-host-error/29063 "2024-03-14T10:14:36Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![RickMA-IT](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/rickma-it/32/18840_2.png) [@RickMA-IT](https://forum.djangoproject.com/u/RickMA-IT)\
**Post date:** [March 14, 2024, 10:14am UTC](https://forum.djangoproject.com/t/dissallowed-host-error/29063/1 "2024-03-14T10:14:36Z")

</div>

Hello, I recently changed one of my subdomains of my ssl certificate and created a new one. In the old situation all the domains worked. In the new situation, [hub.perfotec.com](http://hub.perfotec.com) (which is the new one) gives the following error:

ERROR 2024-03-14 10:27:52,433 exception Invalid HTTP\_HOST header: ‘[hub.perfotec.com](http://hub.perfotec.com)’. You may need to add ‘[hub.perfotec.com](http://hub.perfotec.com)’ to ALLOWED\_HOSTS.  
Traceback (most recent call last):  
File “/usr/local/lib/python3.8/site-packages/django/core/handlers/exception.py”, line 56, in inner  
response = get\_response(request)  
File “/usr/local/lib/python3.8/site-packages/django/utils/deprecation.py”, line 135, in **call**  
response = self.process\_request(request)  
File “/usr/local/lib/python3.8/site-packages/django/middleware/common.py”, line 48, in process\_request  
host = request.get\_host()  
File “/usr/local/lib/python3.8/site-packages/django/http/request.py”, line 152, in get\_host  
raise DisallowedHost(msg)  
django.core.exceptions.DisallowedHost: Invalid HTTP\_HOST header: ‘[hub.perfotec.com](http://hub.perfotec.com)’. You may need to add ‘[hub.perfotec.com](http://hub.perfotec.com)’ to ALLOWED\_HOSTS.  
WARNING 2024-03-14 10:27:52,434 log Bad Request: /  
ERROR 2024-03-14 10:27:52,559 exception Invalid HTTP\_HOST header: ‘[hub.perfotec.com](http://hub.perfotec.com)’. You may need to add ‘[hub.perfotec.com](http://hub.perfotec.com)’ to ALLOWED\_HOSTS.  
Traceback (most recent call last):  
File “/usr/local/lib/python3.8/site-packages/django/core/handlers/exception.py”, line 56, in inner  
response = get\_response(request)  
File “/usr/local/lib/python3.8/site-packages/django/utils/deprecation.py”, line 135, in **call**  
response = self.process\_request(request)  
File “/usr/local/lib/python3.8/site-packages/django/middleware/common.py”, line 48, in process\_request  
host = request.get\_host()  
File “/usr/local/lib/python3.8/site-packages/django/http/request.py”, line 152, in get\_host  
raise DisallowedHost(msg)  
django.core.exceptions.DisallowedHost: Invalid HTTP\_HOST header: ‘[hub.perfotec.com](http://hub.perfotec.com)’. You may need to add ‘[hub.perfotec.com](http://hub.perfotec.com)’ to ALLOWED\_HOSTS.

All the other domains are still working. These domains are also not in the ALLOWED\_HOSTS. The server name in the nginx config is [amap.perfotec.com](http://amap.perfotec.com) and not changed in the new situation. Some other domains like [clmsv2.perfotec.com](http://clmsv2.perfotec.com) are still working with this config.

Does anyone know the reasen for this error and how to solve it?

---

<div class="post-metadata">

**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\
**Post date:** [March 14, 2024, 11:52am UTC](https://forum.djangoproject.com/t/dissallowed-host-error/29063/2 "2024-03-14T11:52:20Z")

</div>

The specific and direct reason is that requests are being passed to Django with the hosts header set to “[hub.perfotec.com](http://hub.perfotec.com)”.

To try and answer “why”, we’d need more information. We could start with knowing how you are running your Django project, what your nginx configuration is that is forwarding the requests to Django, and what your current ALLOWED\_HOSTS setting is.

To solve it, the first idea would be to add “[hub.perfotec.com](http://hub.perfotec.com)” to your ALLOWED\_HOSTS setting.

---

<div class="post-metadata">

**Author:** ![RickMA-IT](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/rickma-it/32/18840_2.png) [@RickMA-IT](https://forum.djangoproject.com/u/RickMA-IT)\
**Post date:** [March 14, 2024, 3:45pm UTC](https://forum.djangoproject.com/t/dissallowed-host-error/29063/3 "2024-03-14T15:45:44Z")

</div>

I’m running my django project in docker contrainer on a Ubuntu server;

This is my Allowed hosts:  
ALLOWED\_HOSTS = os.environ.get(“DJANGO\_ALLOWED\_HOSTS”).split(" ")

this is my ngix config:

upstream clmsv2 {  
server web:8000;  
}

server {  
listen 80;  
server\_name [amap.perfotec.com](http://amap.perfotec.com);

```
location / {
    return 301 https://$host$request_uri;
}

location /.well-known/acme-challenge/ {
    root /var/www/certbot;
}

```

}

server {

```
listen 443 ssl;
server_name amap.perfotec.com;

location / {
    proxy_pass http://clmsv2;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Real-IP $remote_addr;
	proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header Host $host;
    proxy_redirect off;
    client_max_body_size 1000M;
    proxy_read_timeout 10800s;
    proxy_connect_timeout 10800s;
}

location /static/ {
    alias /usr/src/app/staticfiles/;
}

location /media/ {
    alias /usr/src/app/mediafiles/;
    client_max_body_size 1000M;
}

#subdomain gets -0001 suffix
ssl_certificate /etc/letsencrypt/live/amap.perfotec.com-0002/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/amap.perfotec.com-0002/privkey.pem;
include /etc/letsencrypt/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

```

}

---

<div class="post-metadata">

**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\
**Post date:** [March 14, 2024, 4:13pm UTC](https://forum.djangoproject.com/t/dissallowed-host-error/29063/4 "2024-03-14T16:13:06Z")

</div>

> [@RickMA-IT](#):
>
> I’m running my django project in docker contrainer on a Ubuntu server;

But how are you running it? Gunicorn? uWSGI? Something else?

> [@RickMA-IT](#):
>
> This is my Allowed hosts:  
> ALLOWED\_HOSTS = os.environ.get(“DJANGO\_ALLOWED\_HOSTS”).split(" ")

Side note: This doesn’t answer the question. It shows where the value is coming from to populate that setting, but does not show what the setting is.

Side note 2: As it turns out, neither of those questions appear to be particularly critical at this time.

In your configuration you have:

> [@RickMA-IT](#):
>
> ```auto
> proxy_set_header Host $host;
> 
> ```

This means that nginx is going to take the Host header as supplied by the browser, and pass that through to Django. In the case of a typical http request by a browser, that header will come from the url specified in the address bar, for example in this case, `https://hub.perfotec.com/...`

So yes, the answer here is to add `"hub.perfotec.com"` to your ALLOWED\_HOSTS setting.

---

<div class="post-metadata">

**Author:** ![RickMA-IT](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/rickma-it/32/18840_2.png) [@RickMA-IT](https://forum.djangoproject.com/u/RickMA-IT)\
**Post date:** [March 14, 2024, 4:38pm UTC](https://forum.djangoproject.com/t/dissallowed-host-error/29063/5 "2024-03-14T16:38:06Z")

</div>

> [@KenWhitesell](#):
>
> But how are you running it? Gunicorn? uWSGI? Something else?

I’m running uWSGI.

Maybe a stupid question: where can I find my ALLOWED\_HOSTS setting on the server?  
I didn’t create this part of the app by myself

this is the hosts I can find on my PC but does not contain the working URL’s and is not used in my version control.  
DJANGO\_ALLOWED\_HOSTS=localhost 127.0.0.1 192.168.20.106 146.185.129.161 [::1]

---

<div class="post-metadata">

**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\
**Post date:** [March 14, 2024, 5:11pm UTC](https://forum.djangoproject.com/t/dissallowed-host-error/29063/6 "2024-03-14T17:11:15Z")

</div>

> [@RickMA-IT](#):
>
> ALLOWED\_HOSTS = os.environ.get(“DJANGO\_ALLOWED\_HOSTS”).split(" ")

You’re looking for a setting for “DJANGO\_ALLOWED\_HOSTS” defined (possibly) in any of the Dockerfile, docker-compose.yaml file, in the docker build file, in the docker run command, set in the environment for the user account under which the container is run, in the process manager being used, in the command line that the docker run command uses, or possibly somewhere else as well. (There are _many_ different places in which an environment can be set.) It all depends upon how the images are built and the containers are run.

It’s a little easier if you were running uWSGI directly - using docker greatly multiplies the number of places where an environment variable can be set.

---

<div class="post-metadata">

**Author:** ![RickMA-IT](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/rickma-it/32/18840_2.png) [@RickMA-IT](https://forum.djangoproject.com/u/RickMA-IT)\
**Post date:** [March 15, 2024, 1:07pm UTC](https://forum.djangoproject.com/t/dissallowed-host-error/29063/7 "2024-03-15T13:07:24Z")

</div>

I found the a .env file which contains the ALLOWED\_HOSTS:  
This contains the working url’s such as [amap.perfotec.com](http://amap.perfotec.com) but also the old url [maphub.perfotec.com](http://maphub.perfotec.com).

I changed maphub to hub and saved the file but when I restart the server, it is changed back to maphub.

Any idea how I can ensure [hub.perfotec.com](http://hub.perfotec.com) stays in the file after restart?

---

<div class="post-metadata">

**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\
**Post date:** [March 15, 2024, 1:23pm UTC](https://forum.djangoproject.com/t/dissallowed-host-error/29063/8 "2024-03-15T13:23:47Z")

</div>

I can’t answer that. That’s something needing to be addressed in how you’re creating those containers.

---

<div class="post-metadata">

**Author:** ![RickMA-IT](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/rickma-it/32/18840_2.png) [@RickMA-IT](https://forum.djangoproject.com/u/RickMA-IT)\
**Post date:** [March 15, 2024, 2:22pm UTC](https://forum.djangoproject.com/t/dissallowed-host-error/29063/9 "2024-03-15T14:22:56Z")

</div>

I found a variable file in the gitlab CI/CD which includes maphub. I changed that to hub and it is working now.  
Thank for your help!