Bad Request when DEBUG=False and missing ALLOWED_HOST

[lukpueh]

In DEBUG=False mode Django requires the setting ALLOWED_HOST listing allowed hosts, or else it responds with HTTP 400 (Bad request), see:

• Django settings
• Django Anti Patterns
• exception SuspiciousOperation
• Stack Overflow - django-gives-bad-request-400-when-debug-false

This should be explicitly mentioned in settings_base.py or settings.py as a placeholder or comment and/or in the Installation docs.

[aaaaalbert]

Thanks for the insight! We don't have multiple virtual hosts per server in our current live deployments at the moment; however, it's obviously a requirement from Django to strongly and explicitly whitelist thoses web server hosts that a browser may send requests to. @lukpueh or @RohanBhirangi, do you want to suggest patches?

[aaaaalbert]

I'll make ALLOWED_HOSTS a mandatory setting, and here's why: Testing with the latest version (SeattleTestbed/custominstallerbuilder@3f027f2) when unset causes this message in the Apache error log,

DisallowedHost: Invalid HTTP_HOST header: 'seattle-dev.engineering.nyu.edu'. You may need to add u'seattle-dev.engineering.nyu.edu' to ALLOWED_HOSTS.

My browser shows a nondescript 500 Internal Server Error page.

[aaaaalbert]

Alright, SeattleTestbed/custominstallerbuilder@55d625e and SeattleTestbed/docs@27549f0 fix this issue for SeattleTestbed. We can close this issue following the next sync/pull from there.