Bad request (400) using nginx on ubuntu with Django

Question

I made my own config for my web server and everything is working perfectly if I access my website by IP - http://179.188.3.54

I didn't change my domain yet, I modified my /etc/hosts local like that:

179.188.3.54     cinegloria.com

So, when I try to access my website on my browser I get bad request (400). Here is my nginx config:

server {
listen 80 default_server;
listen [::]:80 default_server ipv6only=on;

root /usr/share/nginx/www;
index index.html index.htm;

access_log /var/log/nginx/domain-access.log;
error_log /var/log/nginx/error.log;

server_name cinegloria.com www.cinegloria.com;

location /static {
        alias /cinegloria/cinegloria/cinegloria/static/;
}

location / {
    proxy_pass_header Server;
    proxy_set_header Host $http_host;
    proxy_redirect off;
    proxy_set_header X-Forwarded-For  $remote_addr;
    proxy_set_header X-Scheme $scheme;
    proxy_connect_timeout 10;
    proxy_read_timeout 10;
    proxy_pass http://0.0.0.0:8000/;
    fastcgi_split_path_info ^()(.*)$;
}
}

I have no clue what can be wrong, as far I know I dont have to change anything else. Any ideas?

Answer 1

What mean proxy_pass http://0.0.0.0:8000/ ? Maybe there must be 127.0.0.1 or 179.188.3.54

And check your port in proxy_pass

root@RDE-1.3:~# curl -I http://179.188.3.54
HTTP/1.1 200 OK
Server: nginx/1.1.19
Date: Tue, 24 Feb 2015 15:46:10 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
X-Frame-Options: SAMEORIGIN

root@RDE-1.3:~#
root@RDE-1.3:~#
root@RDE-1.3:~# curl -I http://179.188.3.54:8000


curl: (7) couldn't connect to host

PS: Did you add ALLOWED_HOSTS? Default: [] (Empty list)

ALLOWED_HOSTS = [
    '.example.com',  # Allow domain and subdomains
    '.example.com.',  # Also allow FQDN and subdomains
]

A list of strings representing the host/domain names that this Django site can serve. This is a security measure to prevent an attacker from poisoning caches and password reset emails with links to malicious hosts by submitting requests with a fake HTTP Host header, which is possible even under many seemingly-safe web server configurations.

Values in this list can be fully qualified names (e.g. 'www.example.com'), in which case they will be matched against the request’s Host header exactly (case-insensitive, not including port). A value beginning with a period can be used as a subdomain wildcard: '.example.com' will match example.com, www.example.com, and any other subdomain of example.com. A value of '*' will match anything; in this case you are responsible to provide your own validation of the Host header (perhaps in a middleware; if so this middleware must be listed first in MIDDLEWARE_CLASSES).

If the Host header (or X-Forwarded-Host if USE_X_FORWARDED_HOST is enabled) does not match any value in this list, the django.http.HttpRequest.get_host() method will raise SuspiciousOperation.

When DEBUG is True or when running tests, host validation is disabled; any host will be accepted. Thus it’s usually only necessary to set it in production.

This validation only applies via get_host(); if your code accesses the Host header directly from request.META you are bypassing this security protection.