DisallowedHost (SuspiciousOperation) and Media Visibility

Host Header Validation and Media Exposure

In Django environments where DEBUG = False, the ALLOWED_HOSTS setting acts as a primary defense against Host-header-based attacks. If a request arrives with a Host header that does not match any entry in this list, Django raises a DisallowedHost exception (a subclass of SuspiciousOperation), resulting in an HTTP 400 response.

While request routing is gated by this mechanism, the visibility of uploaded files stored via MEDIA_ROOT is handled outside of Django's internal permission system. Because Django does not provide a built-in default for per-object media authorization, files are often served directly by the web server or object storage backend.

This creates a design uncertainty regarding the transition from public to private file delivery. When moving from a public MEDIA_URL to a restricted access model, developers must choose between streaming files via FileResponse or implementing server-level redirects like X-Accel-Redirect.

• How does the framework handle the default visibility of files when using third-party storage backends compared to local storage?
• What is the recommended architectural pattern to ensure DisallowedHost protections extend to the delivery of sensitive media assets?