Keith SmithandClaude Sonnet 4.5 e7fbef75e9 Fix HIGH Security Issue: Require ALLOWED_HOSTS in production ...

Added validation to ensure ALLOWED_HOSTS is explicitly set in production.

Changes:
- Check if ALLOWED_HOSTS environment variable is set
- Raise ValueError with helpful message if not set
- Use os.environ['ALLOWED_HOSTS'] instead of .get() to enforce requirement
- Prevents empty or missing ALLOWED_HOSTS from bypassing host validation

Security impact:
- Prevents host header injection attacks
- Blocks cache poisoning via host header manipulation
- Ensures production deployments have explicit allowed hosts configured
- Fails fast with clear error message if misconfigured

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

2025-12-23 06:23:34 -07:00

..

__init__.py

Initial commit: KeepItGoing task management server

2025-12-18 17:41:29 -07:00

base.py

Fix HIGH Security Issue: Add file upload validation for avatars

2025-12-23 06:23:11 -07:00

development.py

Add tasks.firebugit.com to development server configuration

2025-12-23 06:08:39 -07:00

production.py

Fix HIGH Security Issue: Require ALLOWED_HOSTS in production

2025-12-23 06:23:34 -07:00

selfhosted.py

Fix Critical Security Issue: Remove weak default SECRET_KEY

2025-12-22 22:31:46 -07:00