Nginx – What exactly is an invalid HTTP_HOST header

amazon ec2amazon-elbdjangonginxUbuntu

I've implemented Django's relatively new allowed hosts setting, which is meant to prevent attackers from submitting requests with a fake HTTP Host header.

Since adding that setting, I now get anywhere from 20-100 emails a day notifying me of invalid HTTP_HOST headers. I've copied in an example of a typical error message below.

I'm hosting my site on EC2, and am relatively new to setting up/maintaining a server, so my question is what exactly is happening here, and what is the best way to manage these invalid and I assume malicious requests?

[Django] ERROR: Invalid HTTP_HOST header: 'www.launchastartup.com'.You may need to add u'www.launchastartup.com' to ALLOWED_HOSTS.

Best Answer

  1. it looks like Amazon has given you IP address which has been assigned to some other customer previously and this customer has not changed A record for their domain name.
  2. There are bots or crawlers who crawl internet all the time. Vulnerability scanners, web crawlers, monitoring applications.

You should not worry about them, it is background noise of the internet.

Related Topic