Django Redis backend for sessions on Heroku

Session queries take significant time at each view request. To bypass PostgreSQL and obtain the session information, you can use Redis.

On Heroku, add RedisCloud addon to your app. Then install django-redis-sessions and  add the following lines to your production settings file.

########## REDIS SESSION ###########
from os import environ

redis_url = environ.get("REDISCLOUD_URL")
credential_part, host_part = redis_url.split("//")[1].split("@")
rediscloud, rpassword = credential_part.split(":")
rhost, rport = host_part.split(":")

SESSION_REDIS_PASSWORD = rpassword
SESSION_REDIS_HOST = rhost
SESSION_REDIS_PORT = int(rport)
SESSION_ENGINE = 'redis_sessions.session'
SESSION_REDIS_DB = 0
SESSION_REDIS_PREFIX = 'session'
######## END REDIS SESSION #########

Avoiding fake server requests in nginx

I have been having requests to my server with HTTP_HOST header gameframe.net or server5.cyberpods.net which are not related to me. They were causing error mails sent to me by my Django site since these domains were not listed in my ALLOWED_HOSTS list. I was tired of having error messages every day so after some research  I found the solution.

I told my nginx server to listen only my own domains but it was listening to other domains as well. I added the following block to the top of my config file

server {
        return 404;
}

before the original server settings:

server {
       listen 80;
       server_name my.domain.com myother.domain.com;
       ...
}

This way any domain that is not in my list gets 404 by default. Hope it helps!

Django & Jenkins: Continuous Integration

In these days, I'm curious about continuous integration systems and would like to use Jenkins for automating deployment & test of django projects. Here are some nice pages/presentations on this topic I'd like to drop a note on.

• Configuring Jenkins continuous integration server to work with Git 
• Continuous integration of Django projects with Jenkins
• Continuous Integration with Jenkins
• Towards Continuous Deployment with Django
• Django-Jenkins
• Tips/Process for web-development using Django in a small team
• Continuous Deployment to Heroku With Jenkins
• Heroku staging environment with jenkins
• Buildbot 

Fix for SuspiciousOperation: Invalid HTTP_HOST header

With Django 1.5, HTTP_HOST header filter is applied to the requests.  If the HTTP_HOST header is not among the ALLOWED_HOSTS list in the settings.py, an error is raised, saying this is a suspicious operation.

Let me give an example. Someone (who is not Google), is trying to reach my IP address with the HTTP_HOST www.google.com as if I'm hosting the google.com homepage.:

SuspiciousOperation: Invalid HTTP_HOST header (you may need to set ALLOWED_HOSTS): www.google.com


This happens frequently, leading to emails sent to the admins which is annoying. To overcome this, you can add the IP Address of the requester to /etc/hosts.deny file.

Indeed I thought I could put a hostname filter in nginx configuration, especially in the listen part but my configuration did not have an effect.

The attacker tries to exploit a vulnerability and performs a scan over the web. They seem to be from Vietnam.