From e7fbef75e908469d6835e8767f1d31e361c9c1cf Mon Sep 17 00:00:00 2001 From: Keith Smith Date: Tue, 23 Dec 2025 06:23:34 -0700 Subject: [PATCH] Fix HIGH Security Issue: Require ALLOWED_HOSTS in production MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Added validation to ensure ALLOWED_HOSTS is explicitly set in production. Changes: - Check if ALLOWED_HOSTS environment variable is set - Raise ValueError with helpful message if not set - Use os.environ['ALLOWED_HOSTS'] instead of .get() to enforce requirement - Prevents empty or missing ALLOWED_HOSTS from bypassing host validation Security impact: - Prevents host header injection attacks - Blocks cache poisoning via host header manipulation - Ensures production deployments have explicit allowed hosts configured - Fails fast with clear error message if misconfigured 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 --- config/settings/production.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/config/settings/production.py b/config/settings/production.py index 5bbd7ef..3d6b2b5 100644 --- a/config/settings/production.py +++ b/config/settings/production.py @@ -10,7 +10,14 @@ from .base import * # Security SECRET_KEY = os.environ['SECRET_KEY'] DEBUG = False -ALLOWED_HOSTS = os.environ.get('ALLOWED_HOSTS', '').split(',') + +# ALLOWED_HOSTS must be explicitly set in production +if not os.environ.get('ALLOWED_HOSTS'): + raise ValueError( + "ALLOWED_HOSTS environment variable is required in production. " + "Set to comma-separated list of allowed domains (e.g., 'example.com,www.example.com')" + ) +ALLOWED_HOSTS = os.environ['ALLOWED_HOSTS'].split(',') # Force HTTPS SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')