Django "DisallowedHost: Invalid HTTP_HOST header" (ALLOWED_HOSTS) in CI

By Kaveh Alemi·Latchkey

Django validates the Host header against ALLOWED_HOSTS. An integration or smoke test hit the app with a host (a container name, an IP, testserver) that the active settings did not whitelist, so the request is rejected.

What this error means

A test or live request fails with "DisallowedHost: Invalid HTTP_HOST header: '127.0.0.1:8000'. You may need to add '127.0.0.1' to ALLOWED_HOSTS."

python

django.core.exceptions.DisallowedHost: Invalid HTTP_HOST header: '127.0.0.1:8000'.
You may need to add '127.0.0.1' to ALLOWED_HOSTS.

Common causes

The CI host is not in ALLOWED_HOSTS

Smoke tests hit the app over a host or IP that production settings restrict, so the header check fails.

Empty ALLOWED_HOSTS with DEBUG off

With DEBUG=False and an empty list, Django only accepts testserver; any real host triggers the error.

How to fix it

Add the CI host to the test settings

Whitelist the hosts CI uses in the settings module the job runs with.

settings/ci.py

# settings/ci.py
ALLOWED_HOSTS = ["127.0.0.1", "localhost", "testserver", "web"]

Drive ALLOWED_HOSTS from env

Let CI supply the hosts so the same settings serve local, CI, and production.

settings.py

import os
ALLOWED_HOSTS = os.environ.get("ALLOWED_HOSTS", "127.0.0.1,localhost").split(",")

How to prevent it

Whitelist the exact hosts CI smoke tests use.
Drive ALLOWED_HOSTS from env so environments differ without code edits.
Remember testserver is the only default host under DEBUG=False.

Frequently asked questions

What causes ""Invalid HTTP_HOST header""?