Default ALLOWED_HOSTS to [] but preflight error if not set

davegaeddert · davegaeddert · commit d3cb7712b9ec · 2025-09-22T21:29:23.000-05:00
diff --git a/demos/full/app/settings.py b/demos/full/app/settings.py
@@ -1,5 +1,4 @@
 SECRET_KEY = "test"
-ALLOWED_HOSTS = []
 DEBUG = True
 URLS_ROUTER = "app.urls.AppRouter"
 
diff --git a/plain-admin/tests/app/settings.py b/plain-admin/tests/app/settings.py
@@ -1,5 +1,4 @@
 SECRET_KEY = "test"
-ALLOWED_HOSTS = []
 URLS_ROUTER = "app.urls.AppRouter"
 INSTALLED_PACKAGES = [
     "plain.auth",
diff --git a/plain-api/tests/app/settings.py b/plain-api/tests/app/settings.py
@@ -1,4 +1,3 @@
 SECRET_KEY = "test"
-ALLOWED_HOSTS = []
 URLS_ROUTER = "app.urls.AppRouter"
 INSTALLED_PACKAGES = []
diff --git a/plain-auth/tests/app/settings.py b/plain-auth/tests/app/settings.py
@@ -1,5 +1,4 @@
 SECRET_KEY = "test"
-ALLOWED_HOSTS = []
 URLS_ROUTER = "app.urls.AppRouter"
 INSTALLED_PACKAGES = [
     "plain.auth",
diff --git a/plain-dev/plain/dev/core.py b/plain-dev/plain/dev/core.py
@@ -1,4 +1,3 @@
-import json
 import os
 import platform
 import socket
@@ -136,7 +135,6 @@ def run(self):
 
         self.symlink_plain_src()
         self.modify_hosts_file()
-        self.set_allowed_hosts()
 
         click.secho("→ Running preflight checks... ", dim=True, nl=False)
         self.run_preflight()
@@ -261,19 +259,6 @@ def modify_hosts_file(self):
                 )
                 sys.exit(1)
 
-    def set_allowed_hosts(self):
-        if "PLAIN_ALLOWED_HOSTS" not in os.environ:
-            hostnames = [self.hostname]
-            if self.tunnel_url:
-                # Add the tunnel URL to the allowed hosts
-                hostnames.append(self.tunnel_url.split("://")[1])
-            allowed_hosts = json.dumps(hostnames)
-            self.plain_env["PLAIN_ALLOWED_HOSTS"] = allowed_hosts
-            self.custom_process_env["PLAIN_ALLOWED_HOSTS"] = allowed_hosts
-            click.secho(
-                f"Automatically set PLAIN_ALLOWED_HOSTS={allowed_hosts}", dim=True
-            )
-
     def run_preflight(self):
         if subprocess.run(["plain", "preflight"], env=self.plain_env).returncode:
             click.secho("Preflight check failed!", fg="red")
diff --git a/plain-dev/tests/settings.py b/plain-dev/tests/settings.py
@@ -1,4 +1,3 @@
-ALLOWED_HOSTS = []
 INSTALLED_PACKAGES = [
     "plain.work",
 ]
diff --git a/plain-elements/tests/app/settings.py b/plain-elements/tests/app/settings.py
@@ -1,4 +1,3 @@
 SECRET_KEY = "test"
-ALLOWED_HOSTS = []
 URLS_ROUTER = "app.urls.AppRouter"
 INSTALLED_PACKAGES = ["plain.elements"]
diff --git a/plain-flags/tests/app/settings.py b/plain-flags/tests/app/settings.py
@@ -1,5 +1,4 @@
 SECRET_KEY = "test"
-ALLOWED_HOSTS = []
 URLS_ROUTER = "app.urls.AppRouter"
 INSTALLED_PACKAGES = [
     "plain.models",
diff --git a/plain-htmx/tests/app/settings.py b/plain-htmx/tests/app/settings.py
@@ -1,5 +1,4 @@
 SECRET_KEY = "test"
-ALLOWED_HOSTS = []
 URLS_ROUTER = "app.urls.AppRouter"
 INSTALLED_PACKAGES = [
     "plain.htmx",
diff --git a/plain-models/tests/app/settings.py b/plain-models/tests/app/settings.py
@@ -1,5 +1,4 @@
 SECRET_KEY = "test"
-ALLOWED_HOSTS = []
 URLS_ROUTER = "app.urls.AppRouter"
 INSTALLED_PACKAGES = [
     "plain.models",
diff --git a/plain-oauth/tests/app/settings.py b/plain-oauth/tests/app/settings.py
@@ -1,7 +1,6 @@
 from os import environ
 
 SECRET_KEY = "test"
-ALLOWED_HOSTS = []
 URLS_ROUTER = "app.urls.AppRouter"
 INSTALLED_PACKAGES = [
     "plain.auth",
diff --git a/plain-pytest/plain/pytest/plugin.py b/plain-pytest/plain/pytest/plugin.py
@@ -10,12 +10,6 @@ def pytest_configure(config):
     setup()
 
 
-@pytest.fixture(autouse=True, scope="session")
-def _allowed_hosts_testserver():
-    # Add testserver to ALLOWED_HOSTS so the test client can make requests
-    plain_settings.ALLOWED_HOSTS = [*plain_settings.ALLOWED_HOSTS, "testserver"]
-
-
 @pytest.fixture
 def settings():
     class SettingsProxy:
diff --git a/plain-sessions/tests/app/settings.py b/plain-sessions/tests/app/settings.py
@@ -1,5 +1,4 @@
 SECRET_KEY = "test"
-ALLOWED_HOSTS = []
 URLS_ROUTER = "app.urls.AppRouter"
 INSTALLED_PACKAGES = [
     "plain.models",
diff --git a/plain-tunnel/plain/tunnel/README.md b/plain-tunnel/plain/tunnel/README.md
@@ -81,21 +81,6 @@ The tunnel can be configured using environment variables:
 - `PLAIN_TUNNEL_SUBDOMAIN`: Default subdomain to use
 - `PLAIN_TUNNEL_HOST`: Tunnel host (defaults to plaintunnel.com)
 
-### ALLOWED_HOSTS
-
-Depending on your setup, you may need to add your tunnel to the `settings.ALLOWED_HOSTS`. This can be done in `settings.py` or in your dev `.env`:
-
-```bash
-PLAIN_ALLOWED_HOSTS='["*"]'
-```
-
-Or more specifically:
-
-```python
-# settings.py
-ALLOWED_HOSTS = ["myappname.plaintunnel.com"]
-```
-
 ## Installation
 
 Install the `plain.tunnel` package from [PyPI](https://pypi.org/project/plain.tunnel/):
diff --git a/plain-worker/tests/app/settings.py b/plain-worker/tests/app/settings.py
@@ -1,2 +1 @@
 SECRET_KEY = "test"
-ALLOWED_HOSTS = []
diff --git a/plain/plain/cli/agent/request.py b/plain/plain/cli/agent/request.py
@@ -46,136 +46,127 @@ def request(path, method, data, user_id, follow, content_type, headers):
             click.secho("This command only works when DEBUG=True", fg="red", err=True)
             return
 
-        # Temporarily add testserver to ALLOWED_HOSTS so the test client can make requests
-        original_allowed_hosts = settings.ALLOWED_HOSTS
-        settings.ALLOWED_HOSTS = ["*"]
+        # Create test client
+        client = Client()
 
-        try:
-            # Create test client
-            client = Client()
+        # If user_id provided, force login
+        if user_id:
+            try:
+                # Get the User model using plain.auth utility
+                from plain.auth import get_user_model
 
-            # If user_id provided, force login
-            if user_id:
-                try:
-                    # Get the User model using plain.auth utility
-                    from plain.auth import get_user_model
-
-                    User = get_user_model()
-
-                    # Get the user
-                    try:
-                        user = User.query.get(id=user_id)
-                        client.force_login(user)
-                        click.secho(
-                            f"Authenticated as user {user_id}", fg="green", dim=True
-                        )
-                    except User.DoesNotExist:
-                        click.secho(f"User {user_id} not found", fg="red", err=True)
-                        return
-
-                except Exception as e:
-                    click.secho(f"Authentication error: {e}", fg="red", err=True)
-                    return
-
-            # Parse additional headers
-            header_dict = {}
-            for header in headers:
-                if ":" in header:
-                    key, value = header.split(":", 1)
-                    header_dict[key.strip()] = value.strip()
+                User = get_user_model()
 
-            # Prepare request data
-            if data and content_type and "json" in content_type.lower():
+                # Get the user
                 try:
-                    # Validate JSON
-                    json.loads(data)
-                except json.JSONDecodeError as e:
-                    click.secho(f"Invalid JSON data: {e}", fg="red", err=True)
+                    user = User.query.get(id=user_id)
+                    client.force_login(user)
+                    click.secho(
+                        f"Authenticated as user {user_id}", fg="green", dim=True
+                    )
+                except User.DoesNotExist:
+                    click.secho(f"User {user_id} not found", fg="red", err=True)
                     return
 
-            # Make the request
-            method = method.upper()
-            kwargs = {
-                "path": path,
-                "follow": follow,
-                "headers": header_dict or None,
-            }
-
-            if method in ("POST", "PUT", "PATCH") and data:
-                kwargs["data"] = data
-                if content_type:
-                    kwargs["content_type"] = content_type
-
-            # Call the appropriate client method
-            if method == "GET":
-                response = client.get(**kwargs)
-            elif method == "POST":
-                response = client.post(**kwargs)
-            elif method == "PUT":
-                response = client.put(**kwargs)
-            elif method == "PATCH":
-                response = client.patch(**kwargs)
-            elif method == "DELETE":
-                response = client.delete(**kwargs)
-            elif method == "HEAD":
-                response = client.head(**kwargs)
-            elif method == "OPTIONS":
-                response = client.options(**kwargs)
-            elif method == "TRACE":
-                response = client.trace(**kwargs)
-            else:
-                click.secho(f"Unsupported HTTP method: {method}", fg="red", err=True)
+            except Exception as e:
+                click.secho(f"Authentication error: {e}", fg="red", err=True)
+                return
+
+        # Parse additional headers
+        header_dict = {}
+        for header in headers:
+            if ":" in header:
+                key, value = header.split(":", 1)
+                header_dict[key.strip()] = value.strip()
+
+        # Prepare request data
+        if data and content_type and "json" in content_type.lower():
+            try:
+                # Validate JSON
+                json.loads(data)
+            except json.JSONDecodeError as e:
+                click.secho(f"Invalid JSON data: {e}", fg="red", err=True)
                 return
 
-            # Display response information
-            click.secho(
-                f"HTTP {response.status_code}",
-                fg="green" if response.status_code < 400 else "red",
-                bold=True,
-            )
-
-            # Show additional response info first
-            if hasattr(response, "user"):
-                click.secho(f"Authenticated user: {response.user}", fg="blue", dim=True)
-
-            if hasattr(response, "resolver_match") and response.resolver_match:
-                match = response.resolver_match
-                url_name = match.namespaced_url_name or match.url_name or "unnamed"
-                click.secho(f"URL pattern matched: {url_name}", fg="blue", dim=True)
-
-            # Show headers
-            if response.headers:
-                click.secho("Response Headers:", fg="yellow", bold=True)
-                for key, value in response.headers.items():
-                    click.echo(f"  {key}: {value}")
-                click.echo()
-
-            # Show response content last
-            if response.content:
-                content_type = response.headers.get("Content-Type", "")
-
-                if "json" in content_type.lower():
-                    try:
-                        json_data = response.json()
-                        click.secho("Response Body (JSON):", fg="yellow", bold=True)
-                        click.echo(json.dumps(json_data, indent=2))
-                    except Exception:
-                        click.secho("Response Body:", fg="yellow", bold=True)
-                        click.echo(response.content.decode("utf-8", errors="replace"))
-                elif "html" in content_type.lower():
-                    click.secho("Response Body (HTML):", fg="yellow", bold=True)
-                    content = response.content.decode("utf-8", errors="replace")
-                    click.echo(content)
-                else:
+        # Make the request
+        method = method.upper()
+        kwargs = {
+            "path": path,
+            "follow": follow,
+            "headers": header_dict or None,
+        }
+
+        if method in ("POST", "PUT", "PATCH") and data:
+            kwargs["data"] = data
+            if content_type:
+                kwargs["content_type"] = content_type
+
+        # Call the appropriate client method
+        if method == "GET":
+            response = client.get(**kwargs)
+        elif method == "POST":
+            response = client.post(**kwargs)
+        elif method == "PUT":
+            response = client.put(**kwargs)
+        elif method == "PATCH":
+            response = client.patch(**kwargs)
+        elif method == "DELETE":
+            response = client.delete(**kwargs)
+        elif method == "HEAD":
+            response = client.head(**kwargs)
+        elif method == "OPTIONS":
+            response = client.options(**kwargs)
+        elif method == "TRACE":
+            response = client.trace(**kwargs)
+        else:
+            click.secho(f"Unsupported HTTP method: {method}", fg="red", err=True)
+            return
+
+        # Display response information
+        click.secho(
+            f"HTTP {response.status_code}",
+            fg="green" if response.status_code < 400 else "red",
+            bold=True,
+        )
+
+        # Show additional response info first
+        if hasattr(response, "user"):
+            click.secho(f"Authenticated user: {response.user}", fg="blue", dim=True)
+
+        if hasattr(response, "resolver_match") and response.resolver_match:
+            match = response.resolver_match
+            url_name = match.namespaced_url_name or match.url_name or "unnamed"
+            click.secho(f"URL pattern matched: {url_name}", fg="blue", dim=True)
+
+        # Show headers
+        if response.headers:
+            click.secho("Response Headers:", fg="yellow", bold=True)
+            for key, value in response.headers.items():
+                click.echo(f"  {key}: {value}")
+            click.echo()
+
+        # Show response content last
+        if response.content:
+            content_type = response.headers.get("Content-Type", "")
+
+            if "json" in content_type.lower():
+                try:
+                    json_data = response.json()
+                    click.secho("Response Body (JSON):", fg="yellow", bold=True)
+                    click.echo(json.dumps(json_data, indent=2))
+                except Exception:
                     click.secho("Response Body:", fg="yellow", bold=True)
-                    content = response.content.decode("utf-8", errors="replace")
-                    click.echo(content)
+                    click.echo(response.content.decode("utf-8", errors="replace"))
+            elif "html" in content_type.lower():
+                click.secho("Response Body (HTML):", fg="yellow", bold=True)
+                content = response.content.decode("utf-8", errors="replace")
+                click.echo(content)
             else:
-                click.secho("(No response body)", fg="yellow", dim=True)
-
-        finally:
-            # Restore original ALLOWED_HOSTS
-            settings.ALLOWED_HOSTS = original_allowed_hosts
+                click.secho("Response Body:", fg="yellow", bold=True)
+                content = response.content.decode("utf-8", errors="replace")
+                click.echo(content)
+        else:
+            click.secho("(No response body)", fg="yellow", dim=True)
 
     except Exception as e:
         click.secho(f"Request failed: {e}", fg="red", err=True)
diff --git a/plain/plain/internal/middleware/hosts.py b/plain/plain/internal/middleware/hosts.py
diff --git a/plain/plain/preflight/README.md b/plain/plain/preflight/README.md
diff --git a/plain/plain/preflight/security.py b/plain/plain/preflight/security.py
diff --git a/plain/plain/runtime/global_settings.py b/plain/plain/runtime/global_settings.py
diff --git a/plain/tests/app/settings.py b/plain/tests/app/settings.py
diff --git a/plain/tests/test_csrf.py b/plain/tests/test_csrf.py
diff --git a/plain/tests/test_http_hosts.py b/plain/tests/test_http_hosts.py

Original file line number	Diff line number	Diff line change
`@@ -1,5 +1,4 @@`
`1`	`1`	`SECRET_KEY = "test"`
`2`		`-ALLOWED_HOSTS = []`
`3`	`2`	`DEBUG = True`
`4`	`3`	`URLS_ROUTER = "app.urls.AppRouter"`
`5`	`4`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,3 @@`
`1`		`-ALLOWED_HOSTS = []`
`2`	`1`	`INSTALLED_PACKAGES = [`
`3`	`2`	`"plain.work",`
`4`	`3`	`]`