2

I'm using an Nginx webserver on an Ubuntu 18.04 server with Gunicorn and Django. My server is currently down because the incoming host header is always duplicated.

When I make a request to the server, I get an error from Django saying

Invalid HTTP_HOST header: 'dt-testing.com,dt-testing.com'. The domain name provided is not valid according to RFC 1034/1035.

I cannot figure out where the incoming header is being doubled. I have combed my nginx.conf and sites-available files the best I can, and can't find anything suspicious at all.

The sites-available file:

#server { # redirection logic
#        listen 80; # port to listen on
#        #return 301 https://$host$request_uri*;
#        return 301 https://$host$request_uri; # could this be causing the doubling of the URL?
#}

server {
#    listen 443 ssl; # listen for HTTPS
    listen 80; # listen for HTTPS
    server_name dt-testing.com www.dt-testing.com; # server name to use

    location = /favicon.ico { access_log off; log_not_found off; } # site icon to use
    location /static/ { # location of static files
        root /websites/DT/DiamondTutoring/;
    }

    location / { # error is here?
        proxy_pass http://unix:/websites/DT/run/gunicorn.sock; # connector to gunicorn
        proxy_set_header Host $host;
        include proxy_params;
        #error_page 405 =200 $uri;
    }

#    ssl_certificate /etc/letsencrypt/live/dt-testing.com/fullchain.pem; # managed by Certbot
#    ssl_certificate_key /etc/letsencrypt/live/dt-testing.com/privkey.pem; # managed by Certbot


    rewrite_log on;
    error_log /var/log/nginx/error_log;

}

The nginx.conf file

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
    worker_connections 768;
    # multi_accept on;
}



http {

    ##
    # Basic Settings
    ##
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    # server_tokens off;

    # server_names_hash_bucket_size 64;
    # server_name_in_redirect off;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    ##
    # SSL Settings
    ##

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
    ssl_prefer_server_ciphers on;

    ##
    # Logging Settings
    ##

    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;

    ##
    # Gzip Settings
    ##

    gzip on;

    # gzip_vary on;
    # gzip_proxied any;
    # gzip_comp_level 6;
    # gzip_buffers 16 8k;
    # gzip_http_version 1.1;
    # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

    ##
    # Virtual Host Configs
    ##

    #include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}


#mail {
#   # See sample authentication script at:
#   # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
# 
#   # auth_http localhost/auth.php;
#   # pop3_capabilities "TOP" "USER";
#   # imap_capabilities "IMAP4rev1" "UIDPLUS";
# 
#   server {
#       listen     localhost:110;
#       protocol   pop3;
#       proxy      on;
#   }
# 
#   server {
#       listen     localhost:143;
#       protocol   imap;
#       proxy      on;
#   }
#}

Is there anything that I'm missing? I can't figure out where the header would be duplicated and concatenated together.

2 Answers 2

1

I think your nginx.conf is setting the header twice:

proxy_set_header Host $host;
include proxy_params;

So the header is set once in sites-available/, and I would bet that you'll find a second copy inside the proxy_params file which you're including on the next line.

3
  • I totally agree with you, but the thing is that when I take out that line in the sites-available file, I get a server error 500 with Internal Server Error: / KeyError at / 'CONTENT_LENGTH'
    – Max
    Apr 6, 2019 at 18:41
  • forgot to tag you
    – Max
    Apr 6, 2019 at 18:48
  • That's a completely different problem then. I think it means the request now reaches gunicorn just fine, but is rejected by the webapp itself. Apr 6, 2019 at 18:59
1

I figured out what the problem was. I suspect that cerbot renew updated the nginx software somehow, which made it render the configuration file above differently. The line proxy set header was the one doubling the incoming header, but because I had a bug in my Python code on the Django side, it wasn't working.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .