Re: Invalid HTTP_HOST header when website being accessed by public IP

2018-07-03 Thread Kasper Laudrup
Hej again Melvyn, On 07/03/2018 12:13 AM, Melvyn Sopacua wrote: The only reason to set it up like that for HTTPS is that it's possible the SNI name differs from the HTTP Host header. For HTTP redirects it makes no sense: the HTTP header is in plain text and is used to determine the server block

Re: Invalid HTTP_HOST header when website being accessed by public IP

2018-07-02 Thread Melvyn Sopacua
On maandag 2 juli 2018 17:25:20 CEST Kasper Laudrup wrote: > Instead I added the following to my HTTPS server section: > > if ($host != my-website.org { > return 404; > } > > Seems to solve my problem just fine. Letsencrypts certbot had already > done something similar for t

Re: Invalid HTTP_HOST header when website being accessed by public IP

2018-07-02 Thread Kasper Laudrup
Hi Melvyn, On 2018-07-02 11:32, Melvyn Sopacua wrote: On zondag 1 juli 2018 19:10:15 CEST Tomasz Knapik wrote: > Maybe you could restrict host headers at the nginx layer, but I don't > think it's worth your effort... If you think of it like that it seems like a lot of work. But if you simp

Re: Invalid HTTP_HOST header when website being accessed by public IP

2018-07-02 Thread Melvyn Sopacua
On zondag 1 juli 2018 19:10:15 CEST Tomasz Knapik wrote: > Maybe you could restrict host headers at the nginx layer, but I don't > think it's worth your effort... If you think of it like that it seems like a lot of work. But if you simply setup a default server that redirects to the actual Dja

Re: Invalid HTTP_HOST header when website being accessed by public IP

2018-07-01 Thread Kasper Laudrup
Hi Tomasz, On 2018-07-01 19:10, Tomasz Knapik wrote: I don't think that's wise to set allowed hosts to a host you don't want your application to be accessed by. I agree completely, which is why I asked the question. Thanks a lot. Django documentation shows you how you can mute the errors -

Re: Invalid HTTP_HOST header when website being accessed by public IP

2018-07-01 Thread Tomasz Knapik
I don't think that's wise to set allowed hosts to a host you don't want your application to be accessed by. Django documentation shows you how you can mute the errors - https://docs.djangoproject.com/en/2.0/topics/logging/#django-security. It's not technically an error of your application. 'h

Invalid HTTP_HOST header when website being accessed by public IP

2018-07-01 Thread Kasper Laudrup
Hi fellow Django users, I have succesfully deployed a small Django site with uwsgi and Nginx to a virtual server running in Amazons cloud (AWS). I have also succesusfully set up email so I will get an email everytime an error occurs. Quite useful. Now, my problem is, that lately I have been