Skip to content

Remove unnecessary limitation for allowed hosts in development environments #2137

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

Remove unnecessary limitation for allowed hosts in development environments #2137

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 1 addition & 6 deletions djangoproject/settings/dev.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,6 @@
from .common import * # noqa

ALLOWED_HOSTS = [
"www.djangoproject.localhost",
"djangoproject.localhost",
"docs.djangoproject.localhost",
"dashboard.djangoproject.localhost",
] + SECRETS.get("allowed_hosts", [])
ALLOWED_HOSTS = ["*"]
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Technically this could just be done in the docker settings because I think it's only related to running with docker due to the docker network.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree with @marksweb , what is the purpose of changing this part?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I couldn't find a case where we need to keep a whitelist of hosts for development purposes

The purpose is to remove a broken setting that creating extra complexity with no benefit; refactoring.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it's only related to running with docker due to the docker network.

0.0.0.0 is not related to the Docker network.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have you run the site with this configuration, accessed all of the different domains listed in the file, and confirmed that they display the appropriate site?

If the proper host name is not getting through to Django, it seems like the problem needs to be fixed somewhere else.

Copy link
Member Author

@ulgens ulgens Jul 27, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

About foreman, not sure why you think it's wrong but accessing a local project over 0.0.0.0, 127.0.0.1 or localhost is common practice, which I see no issue in having mentioned in a doc. Having the mention of foreman, and the procfile in the repo, is something I'd like to discuss but that would be a separate refactoring discussion.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As I said before, my recommendation is to update the README. This is not a workaround; these are the actual domains you need to use to access the development site, as listed in the README, the ALLOWED_HOSTS setting, the dev_sites fixture, and the django-hosts configuration (djangoproject/hosts.py). They're also the domains used by the test suite. It's the same for the non-Docker setup, and the ALLOWED_HOSTS settings helps you see that you're not using the development server as it was intended.

If you would like to propose a change to allow the main site to be access on localhost:8000 instead of or in addition to www.djangoproject.localhost:8000, the change deserves its own issue where the @django/django-website team and others who work on the site can discuss and decide how to move forward.

Copy link
Member Author

@ulgens ulgens Jul 27, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the clarification. So, we need developers to access the project locally via specific hostnames 👍🏻 Blocking undesired hosts via ALLOWED_HOSTS provides only a partial solution for that need and creates further confusion. It blocks access in particular scenarios, but it doesn't help to find the right entry points or provide any information that the developer is doing something undesired. I think a better solution could be to apply the changes in this PR, and then follow up with forwarding requests from common entry points, such as "0.0.0.0" and "127.0.0.1", to the desired hostnames. I'll create an issue to have a healthier discussion 🌻

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it's only related to running with docker due to the docker network.

0.0.0.0 is not related to the Docker network.

Yeah I don't think that's what I was getting at.

The zero IP allows you to bind all interfaces. It's an easy "allow all" type approach.

Looking back at the screenshots, it's not something you'd then use to connect from the browser.

Copy link
Member Author

@ulgens ulgens Sep 18, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is not a workaround; these are the actual domains you need to use to access the development site, as listed in the README, the ALLOWED_HOSTS setting, the dev_sites fixture, and the django-hosts configuration (djangoproject/hosts.py)

the dev_sites fixture

This can be updated/improved, but I don't have the energy left to start a discussion about another arbitrary choice.

django-hosts configuration (djangoproject/hosts.py)

This is not correct. Hosts config doesn't check for the domain:

host_patterns = [
    host(r"www", settings.ROOT_URLCONF, name="www"),
    host(r"docs", "djangoproject.urls.docs", name="docs"),
    host(r"dashboard", "dashboard.urls", name="dashboard"),
]

So django-hosts doesn't care if you access it via docs.0.0.0.0, docs.localhost or docs.djangoproject.localhost


LOCALE_MIDDLEWARE_EXCLUDED_HOSTS = ["docs.djangoproject.localhost"]

Expand Down
2 changes: 0 additions & 2 deletions djangoproject/settings/docker.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,6 @@

SECRET_KEY = os.environ.get("SECRET_KEY")

ALLOWED_HOSTS = [".localhost", "127.0.0.1", "www.127.0.0.1"]

LOCALE_MIDDLEWARE_EXCLUDED_HOSTS = ["docs.djangoproject.localhost"]

# django-hosts settings
Expand Down