Aws ec2 and Django ALLOWED_HOSTS

amazon ec2amazon-web-servicesdjango

I have put in place my website using Django, on aws EC2, using Elastic Beanstalk. I have set the ALLOWED_HOSTS to ['www.mydomain.fr', '.mydomain.fr'], as recommanded on the Django website.

But I received a lot of alerts like :

Invalid HTTP_HOST header: 'ip-xxx-xx-xx-xxx.eu-west-1.compute.internal'. You may need to add u'ip-xxx-xx-xx-xxx.eu-west-1.compute.internal' to ALLOWED_HOSTS.

where ip-xxx-xx-xx-xxx.eu-west-1.compute.internal is my Private DNS?

Is it safe to add it to the ALLOWED_HOSTS, or could it lead to a security leak?

Thanks a lot

Best Answer

Yes, it's okay. But if you terminate the instance, you'll lose that address. So: you should endeavor to find a more flexible / dynamic way of addressing ALLOWED_HOSTS. You might want to try to set your instance's address as an environment variable.

Or, a less dynamic solution: you might also want to check into using an AWS Elastic IP. Although, this may not possible in a private subnet within a Virtual Private Cloud--although it doesn't sound like that's the case in your set-up.

Here's another option to explore...albeit you'll have to do some research as to whether or not this is secure. See how to fetch an instance's meta data from an AWS IP at this AWS page...

http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AESDG-chapter-instancedata.html

And then leverage the AWS resource suggested above in your Django settings file like so...

# DJANGO PRODUCTION SETTINGS

import requests
from .base import *

########## ALLOWED_HOSTS
from requests.exceptions import ConnectionError

url = "http://169.254.169.254/latest/meta-data/public-ipv4"
try:
    r = requests.get(url)
    instance_ip = r.text
    ALLOWED_HOSTS += [instance_ip]
except ConnectionError:
    error_msg = "You can only run production settings on an AWS EC2 instance"
    raise ImproperlyConfigured(error_msg)
########## END ALLOWED_HOSTS
Related Topic