23

Since the introduction of the ALLOWED_HOSTS setting in django 1.4.4, I get a lot of django error emails to my admin address for exceptions caused by some silly spider looking for vulnerable phpMyAdmin installations or somesuch. These mails are totally valid since the host headers in the spiders' requests are indeed wrong, but I'd rather have django only send me error mails when important things go wrong. Is there a simple method to silence SuspiciousOperation mails, or do I have to go all the way and subclass CommonMiddleware?

6 Answers 6

39

For completeness you can override parts of the logging: (tested on django 1.6):

LOGGING = {
    'version': 1,
    'disable_existing_loggers': False,
    'handlers': {
        'null': {
            'level': 'DEBUG',
            'class': 'logging.NullHandler',
        },
    },
    'loggers': {
        'django.security.DisallowedHost': {
            'handlers': ['null'],
            'propagate': False,
        },
    },
}

Also see Django security docs.

1
  • Awesome answer, thank you for pointing me to docs section - worked like a charm, great work, thank you
    – Radek
    Mar 24, 2018 at 17:56
6

To suppress the admin email, define a logging filter:

def skip_suspicious_operations(record):
    if record.name == 'django.security.DisallowedHost':
        return False
    return True

Then in settings.py add it to the LOGGING dict as a filter:

'filters': {
    'skip_suspicious_operations': { 
        '()': 'django.utils.log.CallbackFilter',
        'callback': skip_suspicious_operations,
    }
}

and add the filter to the mail_admins handler:

'handlers': {
    'mail_admins': {
        'level': 'ERROR',
        'filters': ['skip_suspicious_operations'],
        'include_html' : True,
    }
}

This works in Django 1.6 as is. In Django-1.5 I think the RHS of the comparison with record.name is a little different, but otherwise it should work.

2
  • I think you also need a 'loggers' with a key for 'django.security' inside the LOGGING dict in order to actually catch these messages. Jul 10, 2014 at 18:09
  • why do you check record.name instead of isinstance(record,DisallowedHost)? Jun 28, 2015 at 9:15
4

Apache

If you're using Apache you can filter out the traffic to different hosts from the httpd.conf -- this is a much simpler solution than writing any code. Something like

WSGIPythonPath [your Python path]
ServerSignature Off
ServerTokens Prod

<VirtualHost *:80>
    DocumentRoot /var/www
</VirtualHost>

<VirtualHost *:80>
    ServerName www.myrealhost.com
    rest of apache configuration ....
</VirtualHost>

The first setting will grab everything that doesn't match your server name (e.g. www.myrealhost.com )

Nginx

You can use the same approach in nginx to filter out the traffic to different hosts in your configuration file using the server_name directive like

server {
    # the port your site will be served on
    listen      80;

    # the domain name it will serve for
    server_name www.myrealhost.com;  # optionally include localhost here for local testing

    ...the rest of your nginx config for Django
}
server {
     # You need to provide a default server for all other traffic
    listen 80 default_server;
    server_name  _;

    # If you need a healthcheck route that works with any hostname, unncomment
    # the next three lines
l   #location = /healthcheck {
    #    return 200;
    #}
    location / {
        return 444;
    }
 }
5
  • Would love to see an nginx snippet as well!
    – rrauenza
    Aug 26, 2019 at 0:14
  • @rrauenza Done -- cool that an answer from 6 years ago is still relevant. Aug 26, 2019 at 22:48
  • Thanks! I also found (was doing this yesterday) that you also need to have a default server section that just returns 404.
    – rrauenza
    Aug 26, 2019 at 22:50
  • Yes you do -- I use my default section to provide a healthcheck endpoint that will work with AWS load balancers. Aug 26, 2019 at 22:53
  • Any idea's on how this would get implemented in AWS ElastiBeanstalk? May 3, 2022 at 9:26
1

A bit of googling would have revealed that there's already a bug in Django's bug tracker for this:

https://code.djangoproject.com/ticket/19866

Until there is a fix in (hopefully) Django 1.5.1, there's a workaround involving a log filter.

1
  • 1
    That bug doesn't address sending an email on suspicious operation -- it's about sending a '500' response instead of a '400'. It was fixed in Django 1.6, but an admin email is still generated.
    – Nils
    Jan 16, 2014 at 18:32
0

But wait, there's an app for that!

https://github.com/litchfield/django-safelogging

0

So I typically prefer to just redirect all unmatched vhosts to a single vhost. this is done with a simple addition to the apache.conf file...

<VirtualHost *:80>
    RedirectMatch ^/?(.*) http://www.example.com/$1
</VirtualHost>

The example above would result in a request to any unmatched vhost to redirect to http://www.example.com, while retaining the path component properly.

This also has the added advantage of correcting the case where a user is following an invalid request or some such thing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.