Host validation middleware, require ALLOWED_HOSTS setting, request.host cached property

davegaeddert · davegaeddert · commit 6a4b7be220ab · 2025-09-22T20:59:52.000-05:00
diff --git a/demos/full/app/settings.py b/demos/full/app/settings.py
@@ -1,4 +1,5 @@
 SECRET_KEY = "test"
+ALLOWED_HOSTS = []
 DEBUG = True
 URLS_ROUTER = "app.urls.AppRouter"
 
diff --git a/plain-admin/tests/app/settings.py b/plain-admin/tests/app/settings.py
@@ -1,4 +1,5 @@
 SECRET_KEY = "test"
+ALLOWED_HOSTS = []
 URLS_ROUTER = "app.urls.AppRouter"
 INSTALLED_PACKAGES = [
     "plain.auth",
diff --git a/plain-api/tests/app/settings.py b/plain-api/tests/app/settings.py
@@ -1,3 +1,4 @@
 SECRET_KEY = "test"
+ALLOWED_HOSTS = []
 URLS_ROUTER = "app.urls.AppRouter"
 INSTALLED_PACKAGES = []
diff --git a/plain-auth/tests/app/settings.py b/plain-auth/tests/app/settings.py
@@ -1,4 +1,5 @@
 SECRET_KEY = "test"
+ALLOWED_HOSTS = []
 URLS_ROUTER = "app.urls.AppRouter"
 INSTALLED_PACKAGES = [
     "plain.auth",
diff --git a/plain-dev/tests/settings.py b/plain-dev/tests/settings.py
@@ -1,3 +1,4 @@
+ALLOWED_HOSTS = []
 INSTALLED_PACKAGES = [
     "plain.work",
 ]
diff --git a/plain-elements/tests/app/settings.py b/plain-elements/tests/app/settings.py
@@ -1,3 +1,4 @@
 SECRET_KEY = "test"
+ALLOWED_HOSTS = []
 URLS_ROUTER = "app.urls.AppRouter"
 INSTALLED_PACKAGES = ["plain.elements"]
diff --git a/plain-flags/tests/app/settings.py b/plain-flags/tests/app/settings.py
@@ -1,4 +1,5 @@
 SECRET_KEY = "test"
+ALLOWED_HOSTS = []
 URLS_ROUTER = "app.urls.AppRouter"
 INSTALLED_PACKAGES = [
     "plain.models",
diff --git a/plain-htmx/tests/app/settings.py b/plain-htmx/tests/app/settings.py
@@ -1,4 +1,5 @@
 SECRET_KEY = "test"
+ALLOWED_HOSTS = []
 URLS_ROUTER = "app.urls.AppRouter"
 INSTALLED_PACKAGES = [
     "plain.htmx",
diff --git a/plain-models/tests/app/settings.py b/plain-models/tests/app/settings.py
@@ -1,4 +1,5 @@
 SECRET_KEY = "test"
+ALLOWED_HOSTS = []
 URLS_ROUTER = "app.urls.AppRouter"
 INSTALLED_PACKAGES = [
     "plain.models",
diff --git a/plain-oauth/tests/app/settings.py b/plain-oauth/tests/app/settings.py
@@ -1,6 +1,7 @@
 from os import environ
 
 SECRET_KEY = "test"
+ALLOWED_HOSTS = []
 URLS_ROUTER = "app.urls.AppRouter"
 INSTALLED_PACKAGES = [
     "plain.auth",
diff --git a/plain-sessions/tests/app/settings.py b/plain-sessions/tests/app/settings.py
@@ -1,4 +1,5 @@
 SECRET_KEY = "test"
+ALLOWED_HOSTS = []
 URLS_ROUTER = "app.urls.AppRouter"
 INSTALLED_PACKAGES = [
     "plain.models",
diff --git a/plain-worker/tests/app/settings.py b/plain-worker/tests/app/settings.py
@@ -1 +1,2 @@
 SECRET_KEY = "test"
+ALLOWED_HOSTS = []
diff --git a/plain/plain/csrf/middleware.py b/plain/plain/csrf/middleware.py
@@ -2,7 +2,6 @@
 import re
 from urllib.parse import urlparse
 
-from plain.exceptions import DisallowedHost
 from plain.logs.utils import log_response
 from plain.runtime import settings
 
@@ -81,8 +80,8 @@ def should_allow_request(self, request) -> tuple[bool, str]:
         if origin == "null":
             return False, "Cross-origin request detected - null Origin header"
 
-        try:
-            if (parsed_origin := urlparse(origin)) and (host := request.get_host()):
+        if (parsed_origin := urlparse(origin)) and (host := request.host):
+            try:
                 # Scheme-agnostic host:port comparison
                 origin_host = parsed_origin.hostname
                 origin_port = parsed_origin.port or (
@@ -110,8 +109,8 @@ def should_allow_request(self, request) -> tuple[bool, str]:
                             True,
                             f"Same-origin request - Origin {origin} matches Host {host}",
                         )
-        except (ValueError, DisallowedHost):
-            pass
+            except ValueError:
+                pass
 
         # Origin present but doesn't match host
         return (
diff --git a/plain/plain/exceptions.py b/plain/plain/exceptions.py
@@ -67,12 +67,6 @@ class SuspiciousFileOperation(SuspiciousOperation):
     pass
 
 
-class DisallowedHost(SuspiciousOperation):
-    """HTTP_HOST header contains invalid value"""
-
-    pass
-
-
 class TooManyFieldsSent(SuspiciousOperation):
     """
     The number of fields in a GET or POST request exceeded
diff --git a/plain/plain/http/request.py b/plain/plain/http/request.py
@@ -8,7 +8,6 @@
 from urllib.parse import parse_qsl, quote, urlencode, urljoin, urlsplit
 
 from plain.exceptions import (
-    DisallowedHost,
     ImproperlyConfigured,
     RequestDataTooBig,
     TooManyFieldsSent,
@@ -29,8 +28,6 @@
 from plain.utils.encoding import iri_to_uri
 from plain.utils.http import parse_header_parameters
 
-from .hosts import split_domain_port, validate_host
-
 
 class UnreadablePostError(OSError):
     pass
@@ -123,10 +120,13 @@ def _set_content_type_params(self, meta):
             else:
                 self.encoding = self.content_params["charset"]
 
-    def _get_raw_host(self):
+    @cached_property
+    def host(self):
         """
-        Return the HTTP host using the environment or request headers. Skip
-        allowed hosts protection, so may return an insecure host.
+        Return the HTTP host using the environment or request headers.
+
+        Host validation is performed by HostValidationMiddleware, so this
+        property can safely return the host without any validation.
         """
         # We try three options, in order of decreasing preference.
         if settings.USE_X_FORWARDED_HOST and ("HTTP_X_FORWARDED_HOST" in self.meta):
@@ -141,28 +141,6 @@ def _get_raw_host(self):
                 host = f"{host}:{server_port}"
         return host
 
-    def get_host(self):
-        """Return the HTTP host using the environment or request headers."""
-        host = self._get_raw_host()
-
-        # Allow variants of localhost if ALLOWED_HOSTS is empty and DEBUG=True.
-        allowed_hosts = settings.ALLOWED_HOSTS
-        if settings.DEBUG and not allowed_hosts:
-            allowed_hosts = [".localhost", "127.0.0.1", "[::1]"]
-
-        domain, port = split_domain_port(host)
-        if domain and validate_host(domain, allowed_hosts):
-            return host
-        else:
-            msg = f"Invalid HTTP_HOST header: {host!r}."
-            if domain:
-                msg += f" You may need to add {domain!r} to ALLOWED_HOSTS."
-            else:
-                msg += (
-                    " The domain name provided is not valid according to RFC 1034/1035."
-                )
-            raise DisallowedHost(msg)
-
     def get_port(self):
         """Return the port number for the request as a string."""
         if settings.USE_X_FORWARDED_PORT and "HTTP_X_FORWARDED_PORT" in self.meta:
@@ -220,7 +198,7 @@ def build_absolute_uri(self, location=None):
             location = str(location)
         bits = urlsplit(location)
         if not (bits.scheme and bits.netloc):
-            current_scheme_host = f"{self.scheme}://{self.get_host()}"
+            current_scheme_host = f"{self.scheme}://{self.host}"
 
             # Handle the simple, most common case. If the location is absolute
             # and a scheme or host (netloc) isn't provided, skip an expensive
diff --git a/plain/plain/internal/handlers/base.py b/plain/plain/internal/handlers/base.py
@@ -4,7 +4,7 @@
 from opentelemetry import baggage, trace
 from opentelemetry.semconv.attributes import http_attributes, url_attributes
 
-from plain.exceptions import DisallowedHost, ImproperlyConfigured
+from plain.exceptions import ImproperlyConfigured
 from plain.logs.utils import log_response
 from plain.runtime import settings
 from plain.urls import get_resolver
@@ -17,6 +17,7 @@
 
 # These middleware classes are always used by Plain.
 BUILTIN_BEFORE_MIDDLEWARE = [
+    "plain.internal.middleware.hosts.HostValidationMiddleware",  # Validate Host header first
     "plain.internal.middleware.headers.DefaultHeadersMiddleware",  # Runs after response, to set missing headers
     "plain.internal.middleware.https.HttpsRedirectMiddleware",  # Runs before response, to redirect to HTTPS quickly
     "plain.csrf.middleware.CsrfViewMiddleware",  # Runs before and after get_response...
@@ -78,10 +79,6 @@ def get_response(self, request):
         except KeyError:
             # Missing required WSGI environment variables (e.g. in tests)
             pass
-        except DisallowedHost:
-            # Invalid host header - skip URL_FULL for telemetry but let the
-            # exception be handled normally by middleware for proper 400 response
-            pass
 
         # Add query string if present
         if query_string := request.meta.get("QUERY_STRING"):
diff --git a/plain/plain/internal/middleware/hosts.py b/plain/plain/internal/middleware/hosts.py
@@ -1,19 +1,65 @@
-"""
-Host validation utilities for ALLOWED_HOSTS functionality.
-
-This module provides functions for validating hosts against allowed patterns,
-including domain patterns, wildcards, and CIDR notation for IP ranges.
-"""
-
 import ipaddress
+import logging
 
+from plain.http import HttpRequest, ResponseBadRequest
+from plain.runtime import settings
 from plain.utils.regex_helper import _lazy_re_compile
 
+logger = logging.getLogger(__name__)
+
 host_validation_re = _lazy_re_compile(
     r"^([a-z0-9.-]+|\[[a-f0-9]*:[a-f0-9\.:]+\])(:[0-9]+)?$"
 )
 
 
+class HostValidationMiddleware:
+    """
+    Middleware to validate the Host header against ALLOWED_HOSTS.
+
+    This middleware should run first to ensure all subsequent code can trust
+    that the host header is valid. Returns a 400 Bad Request response if the
+    host is not allowed.
+    """
+
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        if not is_host_valid(request):
+            host = request.host
+            msg = f"Invalid HTTP_HOST header: {host!r}."
+
+            domain, _ = split_domain_port(host)
+            if domain:
+                msg += f" You may need to add {domain!r} to ALLOWED_HOSTS."
+            else:
+                msg += (
+                    " The domain name provided is not valid according to RFC 1034/1035."
+                )
+
+            logger.warning(
+                msg,
+                extra={"status_code": 400, "request": request},
+            )
+
+            return ResponseBadRequest()
+
+        return self.get_response(request)
+
+
+def is_host_valid(request: HttpRequest) -> bool:
+    """
+    Check if the host is valid according to ALLOWED_HOSTS settings.
+    """
+    allowed_hosts = settings.ALLOWED_HOSTS
+
+    if not allowed_hosts:
+        return True  # Allow all hosts if ALLOWED_HOSTS is empty
+
+    domain, _ = split_domain_port(request.host)
+    return bool(domain) and validate_host(domain, allowed_hosts)
+
+
 def split_domain_port(host: str) -> tuple[str, str]:
     """
     Return a (domain, port) tuple from a given host.
@@ -36,7 +82,7 @@ def split_domain_port(host: str) -> tuple[str, str]:
     return domain, port
 
 
-def _is_same_domain(host: str, pattern: str) -> bool:
+def is_same_domain(host: str, pattern: str) -> bool:
     """
     Return ``True`` if the host is either an exact match or a match
     to the wildcard pattern.
@@ -56,7 +102,7 @@ def _is_same_domain(host: str, pattern: str) -> bool:
     )
 
 
-def _parse_ip_address(
+def parse_ip_address(
     host: str,
 ) -> ipaddress.IPv4Address | ipaddress.IPv6Address | None:
     """
@@ -75,7 +121,7 @@ def _parse_ip_address(
         return None
 
 
-def _parse_cidr_pattern(
+def parse_cidr_pattern(
     pattern: str,
 ) -> ipaddress.IPv4Network | ipaddress.IPv6Network | None:
     """
@@ -127,21 +173,21 @@ def validate_host(host: str, allowed_hosts: list[str]) -> bool:
     Return ``True`` for a valid host, ``False`` otherwise.
     """
     # Parse the host as an IP address if possible
-    host_ip = _parse_ip_address(host)
+    host_ip = parse_ip_address(host)
 
     for pattern in allowed_hosts:
         # Wildcard matches everything
         if pattern == "*":
             return True
 
         # Check CIDR notation patterns using walrus operator
-        if network := _parse_cidr_pattern(pattern):
+        if network := parse_cidr_pattern(pattern):
             if host_ip and host_ip in network:
                 return True
             continue
 
         # For non-CIDR patterns, use existing domain matching logic
-        if _is_same_domain(host, pattern):
+        if is_same_domain(host, pattern):
             return True
 
     return False
diff --git a/plain/plain/internal/middleware/https.py b/plain/plain/internal/middleware/https.py
@@ -21,7 +21,6 @@ def __call__(self, request):
 
     def maybe_https_redirect(self, request):
         if self.https_redirect_enabled and not request.is_https():
-            host = request.get_host()
             return ResponseRedirect(
-                f"https://{host}{request.get_full_path()}", status_code=301
+                f"https://{request.host}{request.get_full_path()}", status_code=301
             )
diff --git a/plain/plain/internal/middleware/slash.py b/plain/plain/internal/middleware/slash.py
@@ -65,7 +65,7 @@ def get_full_path_with_slash(self, request):
                 f"You called this URL via {request.method}, but the URL doesn't end "
                 "in a slash and you have APPEND_SLASH set. Plain can't "
                 f"redirect to the slash URL while maintaining {request.method} data. "
-                f"Change your form to point to {request.get_host() + new_path} (note the trailing "
+                f"Change your form to point to {request.host + new_path} (note the trailing "
                 "slash), or set APPEND_SLASH=False in your Plain settings."
             )
         return new_path
diff --git a/plain/plain/runtime/global_settings.py b/plain/plain/runtime/global_settings.py
@@ -25,7 +25,7 @@
 # Hosts/domain names that are valid for this site.
 # "*" matches anything, ".example.com" matches example.com and all subdomains
 # "192.168.1.0/24" matches IP addresses in that CIDR range
-ALLOWED_HOSTS: list[str] = []
+ALLOWED_HOSTS: list[str]
 
 # Default headers for all responses.
 DEFAULT_RESPONSE_HEADERS = {
diff --git a/plain/tests/app/settings.py b/plain/tests/app/settings.py
@@ -1,3 +1,4 @@
+ALLOWED_HOSTS = []
 SECRET_KEY = "secret"
 DEBUG = True
 
diff --git a/plain/tests/test_http_hosts.py b/plain/tests/test_http_hosts.py
@@ -1,6 +1,6 @@
 import pytest
 
-from plain.http.hosts import split_domain_port, validate_host
+from plain.internal.middleware.hosts import split_domain_port, validate_host
 
 
 @pytest.mark.parametrize(
diff --git a/plain/tests/test_wsgi.py b/plain/tests/test_wsgi.py
@@ -8,7 +8,6 @@ def test_wsgi_handler():
     Test the default plain.wsgi.app import and
     basic behavior with minimal environ input.
     """
-
     wsgi = WSGIHandler()
     response = wsgi(
         {

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,5 @@`
`1`	`1`	`SECRET_KEY = "test"`
	`2`	`+ALLOWED_HOSTS = []`
`2`	`3`	`DEBUG = True`
`3`	`4`	`URLS_ROUTER = "app.urls.AppRouter"`
`4`	`5`
Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,4 @@`
	`1`	`+ALLOWED_HOSTS = []`
`1`	`2`	`INSTALLED_PACKAGES = [`
`2`	`3`	`"plain.work",`
`3`	`4`	`]`