Django Settings and Production Web Server Integration: DEBUG and ALLOWED_HOSTS Interaction

Direct answer

With DEBUG=False, Django validates the HTTP Host header of every incoming request against ALLOWED_HOSTS before any middleware or URL routing runs. If no entry matches, Django raises DisallowedHost (a SuspiciousOperation subclass) and the default handler returns HTTP 400 Bad Request — not 404 and not 500. The request never reaches your views.

How validation works

Django compares the Host header (as forwarded by Nginx/Apache via proxy_pass or WSGI) against each entry in ALLOWED_HOSTS. Supported patterns:

• example.com — exact match only.
• .example.com — leading dot matches the domain plus all subdomains.
• * — matches anything, which effectively disables Host header protection and should not be used in production.

Crucially, validation checks the header value, not the server's listen address or the container's internal hostname. In a containerized setup, the public-facing domain must be listed even though the container itself answers to something like app-7f9c… internally.

The empty-list case

With DEBUG=False and ALLOWED_HOSTS = [], every request fails validation, so the entire site returns 400. The empty list is only tolerated under DEBUG=True, where Django falls back to allowing localhost variants for development (the exact fallback set is version-sensitive — check your release notes).

Container and proxy gotchas

• If Nginx rewrites or strips the Host header, Django sees the rewritten value. Ensure proxy_set_header Host $host; so the original public host is forwarded.
• If you set USE_X_FORWARDED_HOST=True, Django validates X-Forwarded-Host instead — proxy header handling must then be consistent with ALLOWED_HOSTS.
• Load-balancer health checks that send an IP or internal hostname as the Host will get 400 unless that host is listed or the proxy rewrites the header. A common fix is a dedicated Nginx health-check location that sets a listed Host.

Recommended configuration

DEBUG = os.environ.get("DJANGO_DEBUG", "false") == "true"
ALLOWED_HOSTS = ["example.com", ".example.com"]

And in Nginx:

location / {
    proxy_pass http://app:8000;
    proxy_set_header Host $host;
}

Verification

1. Run with DEBUG=False and ALLOWED_HOSTS=['example.com'], then curl -H 'Host: evil.com' https://example.com/ — expect 400.
2. Confirm the public domain returns 200 while unmatched hosts return 400.
3. Check logs for Invalid HTTP_HOST header / DisallowedHost entries to see exactly which Host values are rejected.

If your 400s persist after listing the public domain, the one diagnostic detail that changes the recommendation is the exact Host value in the DisallowedHost log line — it reveals whether the proxy is rewriting the header.