{"record":{"id":"d9cec4706d1f58ca","repo":"django/django","slug":"you-must-set-settings-allowed-hosts-if-debug-is-fa","errorCode":null,"errorMessage":"You must set settings.ALLOWED_HOSTS if DEBUG is False.","messagePattern":"You must set settings\\.ALLOWED_HOSTS if DEBUG is False\\.","errorType":"console","errorClass":"CommandError","httpStatus":null,"severity":"error","filePath":"django/core/management/commands/runserver.py","lineNumber":81,"sourceCode":"    def execute(self, *args, **options):\n        if options[\"no_color\"]:\n            # We rely on the environment because it's currently the only\n            # way to reach WSGIRequestHandler. This seems an acceptable\n            # compromise considering `runserver` runs indefinitely.\n            os.environ[\"DJANGO_COLORS\"] = \"nocolor\"\n        super().execute(*args, **options)\n\n    def get_handler(self, *args, **options):\n        \"\"\"Return the default WSGI handler for the runner.\"\"\"\n        return get_internal_wsgi_application()\n\n    def get_check_kwargs(self, options):\n        \"\"\"Validation is called explicitly each time the server reloads.\"\"\"\n        return {\"tags\": set()}\n\n    def handle(self, *args, **options):\n        if not settings.DEBUG and not settings.ALLOWED_HOSTS:\n            raise CommandError(\"You must set settings.ALLOWED_HOSTS if DEBUG is False.\")\n\n        self.use_ipv6 = options[\"use_ipv6\"]\n        if self.use_ipv6 and not socket.has_ipv6:\n            raise CommandError(\"Your Python does not support IPv6.\")\n        self._raw_ipv6 = False\n        if not options[\"addrport\"]:\n            self.addr = \"\"\n            self.port = self.default_port\n        else:\n            m = re.match(naiveip_re, options[\"addrport\"])\n            if m is None:\n                raise CommandError(\n                    '\"%s\" is not a valid port number '\n                    \"or address:port pair.\" % options[\"addrport\"]\n                )\n            self.addr, _ipv4, _ipv6, _fqdn, self.port = m.groups()\n            if not self.port.isdigit():\n                raise CommandError(\"%r is not a valid port number.\" % self.port)","sourceCodeStart":63,"sourceCodeEnd":99,"githubUrl":"https://github.com/django/django/blob/ae25a40be07e8a749edf526df37c93e59d4a22c9/django/core/management/commands/runserver.py#L63-L99","documentation":"Raised by runserver when settings.DEBUG is False and settings.ALLOWED_HOSTS is empty. Django refuses to serve because ALLOWED_HOSTS is a critical security control against HTTP Host header spoofing; with DEBUG off there is no safety net. The check is at the top of handle() before any address/port parsing happens.","triggerScenarios":"Running `python manage.py runserver` while DEBUG=False in settings and ALLOWED_HOSTS = []. This commonly happens when an environment-specific settings file or DJANGO_SETTINGS_MODULE points at production-like settings without configuring ALLOWED_HOSTS.","commonSituations":"Switching from dev settings to a staging/prod settings module, setting DEBUG=False via environment variable, or a CI job that boots runserver against production settings. Also seen when DJANGO_SETTINGS_MODULE is accidentally set to the wrong module.","solutions":["Add ALLOWED_HOSTS = ['127.0.0.1', 'localhost'] (or your actual host) to the settings module used for runserver.","If this is local dev only, keep DEBUG=True so the check is bypassed.","Verify DJANGO_SETTINGS_MODULE points to the intended settings file; set it explicitly if a wrong module is loaded."],"exampleFix":"# before\nDEBUG = False\nALLOWED_HOSTS = []\n\n# after\nDEBUG = False\nALLOWED_HOSTS = ['127.0.0.1', 'localhost']","handlingStrategy":"validation","validationCode":"from django.conf import settings\nif not settings.DEBUG and not settings.ALLOWED_HOSTS:\n    raise SystemExit('Set ALLOWED_HOSTS before running runserver with DEBUG=False')","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always set ALLOWED_HOSTS in non-dev settings files, even if just to ['localhost'].","Use environment-variable-driven settings (e.g. ALLOWED_HOSTS = os.environ['ALLOWED_HOSTS'].split(',')) so config is explicit per environment.","Run a settings sanity check in CI before booting runserver against staging settings."],"tags":["django","settings","security","runserver","allowed-hosts"],"analyzedSha":"ae25a40be07e8a749edf526df37c93e59d4a22c9","analyzedAt":"2026-08-06T21:46:51.801Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}