SH014: Django accepts any Host header¶

Severity: medium · Category: security · Applies to: django

Why it matters¶

ALLOWED_HOSTS = ['*'] turns off Django's Host header validation, which enables cache poisoning and password-reset poisoning attacks.

List the real host names in ALLOWED_HOSTS, for example ['example.com'].

Skip it everywhere in devshield.yml:

ignore:
  - SH014

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH014