Changed "Invalid HTTP_HOST header" error from DisallowedHost to BadRequest.

[yurh]

Now days, there are spiders scanning many kinds of host names.

*.yourdomain.com will cause lots of DisallowedHost errors which will send out thousands of emails to admin.

Use BadRequest will keep silent.

For example:
http://1.2.178.27_www.a.yourdomain.com:8004/sitemap.xml

[github-actions]

Hello! Thank you for your contribution 💪

As it's your first contribution be sure to check out the patch review checklist.

If you're fixing a ticket from Trac make sure to set the "Has patch" flag and include a link to this PR in the ticket!

If you have any design or process questions then you can ask in the Django forum.

Welcome aboard ⛵️!

[RealOrangeOne]

I don't think this is something which Django should handle. Keeping this a specific exception allows Django to flag it in certain ways (like an email, as you say). Rejecting an unknown hostname is not only not a bug, it's a security feature.

If you don't want these errors, you have 2 options:

1. Update ALLOWED_HOSTS to include "*", which avoids the errors you mention. This is probably not ideal, since really you only want a specific set of domains to be used to access your application
2. Change your infrastructure to only serve Django on one domain, and reject all the others. This can be done fairly easily with reverse proxies like nginx, and is usually the default behaviour for many more managed hosting providers (eg Heroku).

The alternative would be filtering out these emails, or using an alternative error monitoring solution, but that's likely a bigger ask.

Regardless, your issue might be better discussed elsewhere, where the community can help resolve your issue. See https://www.djangoproject.com/community/ for places you can get some help.

[nessita]

Thank you @RealOrangeOne, I'm agree fully.