Basic host validation performed even when DEBUG=True

[Will Hardy]

Even when DEBUG=True host validation may fail if eg the hostname contains an invalid character (like _). The debug 500 page is not shown, making the cause of the problem difficult to find.

Even if developers are expected to keep their development hostnames clean and valid, a better debug message would be more useful.

[Will Hardy]

I thought I might take a few minutes to help out, even if only by writing a test.

Which approach do you want to take?

• skip all hostname validation when ALLOWED_HOSTS = ["*"]
• make sure a normal SuspiciousOperation exception is raised (ie no exception when trying to display debug response)
• add a different suggestion in exception message for invalid hostnames (ie invalid, but matched in ALLOWED_HOSTS)

[Will Hardy]

Because the documentation promises that hostname validation is disabled when DEBUG=True, I wrote a patch that does this completely (ie for invalid hostnames too). But I also add an explanation to the SuspiciousOperation exception message as to why an RFC 1034/5 invalid hostname was rejected.

​https://github.com/django/django/pull/996

[FrankBie]

Patch and the Test for Patch are valid and ready to go

[Tim Graham <timograham@…>]

In 1c3c21b38d154eff0286c194711dced2ac39dd3d:

Fixed #19987 -- Disabled host validation when DEBUG=True.

The documentation promises that host validation is disabled when
DEBUG=True, that all hostnames are accepted. Domains not compliant with
RFC 1034/1035 were however being validated, this validation has now been
removed when DEBUG=True.

Additionally, when DEBUG=False a more detailed SuspiciousOperation
exception message is provided when host validation fails because the
hostname is not RFC 1034/1035 compliant.