Server throws DisallowedHost error when accessed via IP address

[madmecodes]

The Django server is throwing DisallowedHost exceptions when users access the application directly via the server's IP address instead
of the domain name.

Long Term Fix: #40

Why is this happening? (Discussion)

1. Internet Bots trying to access?
2. Bad actors trying for direct access to application via IP?
3. Cloud provider health checks or background crawlers, some hosting environments or security scanners occasionally send requests to the raw IP.

[ashkew2202]

This problem might be due to the functionality of IP addresses getting mapped with the domain names, as domain names are unique identities but the IP addresses are limited so nginx binds multiple domain names to same IP and the data is fetched and sent to the right server according to the host metadata that comes with the request i.e the domain name.

[madmecodes]

This problem might be due to the functionality of IP addresses getting mapped with the domain names, as domain names are unique identities but the IP addresses are limited so nginx binds multiple domain names to same IP and the data is fetched and sent to the right server according to the host metadata that comes with the request i.e the domain name.

didnt get you, its a single server application, domain directly map to server/droplet ip, and nginx acting as webserver exposing that ip, and binding to that domain, and traffic serve to the port where docker container running.

[madmecodes]

this might help @ashkew2202 , also if u r interested, in the Long Term Fix: #40

tell me i can provide you the server and cloudflare creds, and you can work on securing the system, it will indeed be a great learning experience.

cat pollz.bits-acm.in 
upstream backend {
    server localhost:6969;
}

upstream websocket {
    server localhost:1401;
}

server {
    server_name pollz.bits-acm.in;

    # Frontend
    root /srv/frontend/pollz-frontend/build;
    index index.html;

    # Django admin static files - MUST come before general /static/
    location /static/admin/ {
        proxy_pass http://backend/static/admin/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Django REST framework static files
    location /static/rest_framework/ {
        proxy_pass http://backend/static/rest_framework/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Backend API
    location /api/ {
        proxy_pass http://backend/api/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Django admin routes
    location ~ ^/(admin|hitler)/ {
        proxy_pass http://backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Django media files
    location /media/ {
        proxy_pass http://backend/media/;
        proxy_set_header Host $host;
    }

    # WebSocket
    location /ws/ {
        proxy_pass http://websocket;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_read_timeout 86400;
    }

    # React static files - serve from build folder (AFTER Django static files)
    location /static/ {
        try_files $uri =404;
        expires 1y;
        add_header Cache-Control "public, immutable";
    }

    # React app - everything else
    location / {
        try_files $uri /index.html;
    }

    access_log /var/log/nginx/pollz.access.log;
    error_log /var/log/nginx/pollz.error.log;

    listen [::]:443 ssl ipv6only=on; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/pollz.bits-acm.in/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/pollz.bits-acm.in/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

server {
    if ($host = pollz.bits-acm.in) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    server_name pollz.bits-acm.in;
    listen 80;
    listen [::]:80;
    return 404; # managed by Certbot
}

[ashkew2202]

I won't be able to find the time to do that, I apologize.

[madmecodes]

lite, np