可以将文章内容翻译成中文,广告屏蔽插件可能会导致该功能失效(如失效，请关闭广告屏蔽插件后再试):
问题:
After upgrading to Django 1.5, I started getting errors like this:
Traceback (most recent call last): File "/usr/local/lib/python2.7/dist-packages/django/core/handlers/base.py", line 92, in get_response response = middleware_method(request) File "/usr/local/lib/python2.7/dist-packages/django/middleware/common.py", line 57, in process_request host = request.get_host() File "/usr/local/lib/python2.7/dist-packages/django/http/request.py", line 72, in get_host "Invalid HTTP_HOST header (you may need to set ALLOWED_HOSTS): %s" % host) SuspiciousOperation: Invalid HTTP_HOST header (you may need to set ALLOWED_HOSTS): www.google.com , POST:, COOKIES:{}, META:{'CONTENT_LENGTH': '', 'CONTENT_TYPE': '', 'DOCUMENT_ROOT': '/etc/nginx/html', 'HTTP_ACCEPT': 'text/html', 'HTTP_HOST': 'www.google.com', 'HTTP_PROXY_CONNECTION': 'close', 'HTTP_USER_AGENT': 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)', 'PATH_INFO': u'/', 'QUERY_STRING': '', 'REMOTE_ADDR': '210.245.91.104', 'REMOTE_PORT': '49347', 'REQUEST_METHOD': 'GET', 'REQUEST_URI': '/', u'SCRIPT_NAME': u'', 'SERVER_NAME': 'www.derekkwok.net', 'SERVER_PORT': '80', 'SERVER_PROTOCOL': 'HTTP/1.0', 'uwsgi.node': 'derekkwok', 'uwsgi.version': '1.4.4', 'wsgi.errors': , 'wsgi.file_wrapper': , 'wsgi.input': , 'wsgi.multiprocess': True, 'wsgi.multithread': False, 'wsgi.run_once': False, 'wsgi.url_scheme': 'http', 'wsgi.version': (1, 0)}>
I've set ALLOWED_HOSTS = ['.derekkwok.net'] in my settings.py file.
What is going on here? It someone pretending to be Google and accessing my site? Or is it a benign case of someone setting their HTTP_HOST header incorrectly?
回答1:
If your ALLOWED_HOSTS is set correctly, then it is possible someone is probing your site for the vulnerability by spoofing the header.
There is discussion right now by the Django developers to change this from a 500 internal server error to a 400 response. See this ticket.
回答2:
If you're using Nginx to forward requests to Django running on Gunicorn/Apache/uWSGI, you can use the following to block bad requests. Thanks to @PaulM for the suggestion and this blog post for an example.
upstream app_server { server unix:/tmp/gunicorn_mydomain.com.sock fail_timeout=0; } server { ... ## Deny illegal Host headers if ($host !~* ^(mydomain.com|www.mydomain.com)$ ) { return 444; } location / { proxy_pass http://app_server; ... } }
回答3:
When using Nginx you could set up you servers in a way only requests to the hosts you want get to Django in the first place. That should give you no SuspiciousOperation errors anymore.
server { # default server listen 80; server_name _ default; return 444; } server { # redirects listen 80; server_name example.com old.stuff.example.com; return 301 http://www.example.com$request_uri; } server { # app listen 80; server_name www.example.com; # only hosts in ALLOWED_HOSTS here location / { # ... } # ... your config/proxy stuff }
回答4:
This is fixed in newer versions of Django, but if you're using an affected version (e.g. 1.5) you can add a filter to your logger handler to get rid of these, as outlined in this blog post.
Spoiler:
from django.core.exceptions import SuspiciousOperation def skip_suspicious_operations(record): if record.exc_info: exc_value = record.exc_info[1] if isinstance(exc_value, SuspiciousOperation): return False return True LOGGING = { 'version': 1, 'disable_existing_loggers': False, 'filters': { 'require_debug_false': { '()': 'django.utils.log.RequireDebugFalse', }, # Define filter 'skip_suspicious_operations': { '()': 'django.utils.log.CallbackFilter', 'callback': skip_suspicious_operations, }, }, 'handlers': { 'mail_admins': { 'level': 'ERROR', # Add filter to list of filters 'filters': ['require_debug_false', 'skip_suspicious_operations'], 'class': 'django.utils.log.AdminEmailHandler' } }, 'loggers': { 'django.request': { 'handlers': ['mail_admins'], 'level': 'ERROR', 'propagate': True, }, } }
