CODEWITHSUNDEEP
djangonginxhttpsgunicorn
Kjell-Bear
Kjell-Bear

Reputation: 769

"Invalid HTTP_HOST header" from unknown domain

I am using Nginx and Gunicorn to host a Django project. I need to secure this site, and as a test I set up Let's encrypt to an unused domain of mine. While tailing the Django access log, I noticed the following entry from time to time:

Invalid HTTP_HOST header: 'aydinfatih.com'. You may need to add u'aydinfatih.com' to ALLOWED_HOSTS.

This is an unknown domain to me, and while trying to access the domain (it got 400 response), I could se more of these log entries on my server. What is this? Is it related to my SSL-setup, and an indication that it's not secure?

server {
    server_name example.com example.com;

    location /static/ {
        root /home/user/project/django-project;
    }

    location /media/ {
        root /home/user/project/django-project;
    }

    location / {
        include proxy_params;
        proxy_pass http://unix:/home/user/project/project.sock;
    }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    if ($scheme != "https") {
        return 301 https://$host$request_uri;
    } # managed by Certbot

}

server {
    listen 80;
    server_name my.server.ip.here example.com;
    return 301 https://example.com;
}

I added the following to my server block:

if ($host !~* ^(example.com|www.example.com)$ ) {
    return 444;
}

The unknown domain now displays 520. Is this the correct way to deal with this? Something else I've missed?

Upvotes: 2

Views: 1154

Answers (1)

dvnguyen
dvnguyen

Reputation: 3022

I misread your question. Here's a new answer.

Someone configs their DNS record to point their domain name to your server IP. Adding hostname checking certainly helps, but normally we use a default "catch all" server block to handle all unwanted requests:

# "Catch all" server
server {
    server_name _;
    return 444;
}

# Your site settings
server {
    server_name example.com example.com;

    location /static/ {
        root /home/user/project/django-project;
    }

    location /media/ {
        root /home/user/project/django-project;
    }

    location / {
        include proxy_params;
        proxy_pass http://unix:/home/user/project/project.sock;
    }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    if ($scheme != "https") {
        return 301 https://$host$request_uri;
    } # managed by Certbot

}

server {
    listen 80;
    server_name my.server.ip.here example.com;
    return 301 https://example.com;
}

Upvotes: 2

Related Questions