Request Method:	GET
Request URL:	http://127.0.0.1:9100/
Django Version:	3.2
Exception Type:	DisallowedHost
Exception Value:	Invalid HTTP_HOST header: '127.0.0.1:9100'. You may need to add '127.0.0.1' to ALLOWED_HOSTS.
Exception Location:	/usr/local/lib/python3.9/site-packages/django/http/request.py, line 149, in get_host
Python Executable:	/usr/local/bin/python
Python Version:	3.9.25
Python Path:	['/app',\n '/usr/local/lib/python39.zip',\n '/usr/local/lib/python3.9',\n '/usr/local/lib/python3.9/lib-dynload',\n '/usr/local/lib/python3.9/site-packages',\n '/usr/local/lib/python3.9/site-packages/setuptools/_vendor']
Server time:	Mon, 29 Jun 2026 13:14:00 +0000

Traceback \n Switch to copy-and-paste view\n

\n \n /usr/local/lib/python3.9/site-packages/django/core/handlers/exception.py, line 47, in inner\n \n\n \n

\n \n

                response = await sync_to_async(response_for_exception, thread_sensitive=False)(request, exc)

```
            return response
```
```
        return inner
```
```
    else:
```
```
        @wraps(get_response)
```
```
        def inner(request):
```
```
            try:
```

\n \n

                response = get_response(request)

\u2026

\n \n

```
            except Exception as exc:
```

                response = response_for_exception(request, exc)

```
            return response
```
```
        return inner
```

\n \n

\n \n\n \n

\n \n ▶ Local vars\n \n

\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n

Variable	Value
exc	DisallowedHost("Invalid HTTP_HOST header: '127.0.0.1:9100'. You may need to add '127.0.0.1' to ALLOWED_HOSTS.")
get_response	<django.middleware.common.CommonMiddleware object at 0x7ffffc453460>
request	<WSGIRequest: GET '/'>

Variable

Value

exc

DisallowedHost("Invalid HTTP_HOST header: '127.0.0.1:9100'. You may need to add '127.0.0.1' to ALLOWED_HOSTS.")

get_response

<django.middleware.common.CommonMiddleware object at 0x7ffffc453460>

request

<WSGIRequest: GET '/'>

\n \n

\n \n /usr/local/lib/python3.9/site-packages/django/utils/deprecation.py, line 116, in __call__\n \n\n \n
\n \n
2. ```
    def __call__(self, request):
```
3. ```
        # Exit out to async mode, if needed
```
4. ```
        if asyncio.iscoroutinefunction(self.get_response):
```
5. ```
            return self.__acall__(request)
```
6. ```
        response = None
```
7. ```
        if hasattr(self, 'process_request'):
```
\n \n
1. ```
            response = self.process_request(request)
```
  \u2026
\n \n
1. ```
        response = response or self.get_response(request)
```
2. ```
        if hasattr(self, 'process_response'):
```
3. ```
            response = self.process_response(request, response)
```
4. ```
        return response
```
6. ```
    async def __acall__(self, request):
```
\n \n
\n \n\n \n
\n \n ▶ Local vars\n \n
\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
Variable Value
request
<WSGIRequest: GET '/'>
response
None
self
<django.middleware.common.CommonMiddleware object at 0x7ffffc453460>
\n \n

Variable	Value
request	<WSGIRequest: GET '/'>
response	None
self	<django.middleware.common.CommonMiddleware object at 0x7ffffc453460>

\n \n /usr/local/lib/python3.9/site-packages/django/middleware/common.py, line 48, in process_request\n \n\n \n

\n \n

        user_agent = request.META.get('HTTP_USER_AGENT')

```
        if user_agent is not None:
```

            for user_agent_regex in settings.DISALLOWED_USER_AGENTS:

                if user_agent_regex.search(user_agent):

                    raise PermissionDenied('Forbidden user agent')

DisallowedHost at /

Invalid HTTP_HOST header: '127.0.0.1:9100'. You may need to add '127.0.0.1' to ALLOWED_HOSTS.

\n19683 pre> if domain:

                msg += " You may need to add %r to ALLOWED_HOSTS." % domain

            else:

                msg += " The domain name provided is not valid according to RFC 1034/1035."

\n22060 \n22789

Variable	Value
Request Method:	GET
Request URL:	http://127.0.0.1:9100/
Django Version:	3.2
Exception Type:	DisallowedHost
Exception Value:	Invalid HTTP_HOST header: '127.0.0.1:9100'. You may need to add '127.0.0.1&#x\n5260 h>	DisallowedHost
Exception Value:	Invalid HTTP_HOST header: '127.0.0.1:9100'. You may need to add '127.0.0.1' to ALLOWED_HOSTS.
Exception Location:	/usr/local/lib/python3.9/site-packages/django/http/request.py, line 149, in get_host
Python Executable:	/usr/local/bin/python
Python Version:	3.9.25
Python Path:	['/app', '/usr/local/lib/python39.zip', \n9782
exc	DisallowedHost("Invalid HTTP_HOST header: '127.0.0.1:9100'. You may need to add '127.0.0.1' to ALLOWED_HOSTS.")
get_response	<django.middleware.common.CommonMiddleware object at 0x7ffffc453460>
request	<WSGIRequest: GET '/'>
allowed_hosts	['0.0.0.0', 'localhost']
domain	'127.0.0.1'
host	'127.0.0.1:9100'
msg	("Invalid HTTP_HOST header: '127.0.0.1:9100'. You may need to add '127.0.0.1' " 'to ALLOWED_HOSTS.')
port	'9100'
self	<WSGIRequest: GET '/'>

Request information

USER

[unable to retrieve the current user]

GET

No GET data

POST

No POST data

FILES

No FILES data

COOKIES<\n31501

{}

ADMINS

[]

ALLOWED_HOSTS

['0.0.0.0', 'localhost']

APPEND_SLASH

True

AUTHENTICATION_BACKENDS

['django.contrib.auth.backends.ModelBackend']

AUTH_PASSWORD_VALIDATORS PREPEND_WWW

False

ROOT_URLCONF

'ssti_demo.urls'

SECRET_KEY

'********************'

SECURE_BROWSER_XSS_FILTER

False

SECURE_CONTENT_TYPE_NOSNIFF

True

\n--- INSTALLED_APPS\n41696 .DjangoTemplates' IGNORABLE_404_URLS

[]

INSTALLED_APPS

['django.contrib.admin',  'django.contrib.auth',  'django.contrib.contenttypes',  'django.contrib.sessions',  'django.contrib.messages',  'django.contrib.staticfiles',  'ssti_demo']

INTERNAL_IPS

[]

LANGUAGES \n--- SECRET_KEY\n50471 alse ROOT_URLCONF

'ssti_demo.urls'

SECRET_KEY

'********************'

SECURE_BROWSER_XSS_FILTER

False

SECURE_CONTENT_TYPE_NOSNIFF

True

SECURE_HSTS_INCLUDE_SUBDOMAINS

False

\n--- DEBUG\n36766 '%d %b %Y', '%d %b, %Y', '%B %d %Y', '%B %d, %Y', '%d %B %Y', '%d %B, %Y'] DEBUG

True

DEBUG_PROPAGATE_EXCEPTIONS

False

DECIMAL_SEPARATOR

'.'

DEFAULT_AUTO_FIELD

'django.db.models.BigAutoField'

\n36873 %Y', '%d %B, %Y'] DEBUG

True

DEBUG_PROPAGATE_EXCEPTIONS

False

DECIMAL_SEPARATOR

'.'

DEFAULT_AUTO_FIELD

'django.db.models.BigAutoField'

DEFAULT_CHARSET

'utf-8'

\n37500 ET

'utf-8'

DEFAULT_EXCEPTION_REPORTER

'django.views.debug.ExceptionReporter'

DEFAULT_EXCEPTION_REPORTER_FILTER

'django.views.debug.SafeExceptionReporterFilter'

DEFAULT_FILE_STORAGE

'django.core.files.storage.FileSystemStorage'

DEFAULT_FROM_EMAIL 'django.views.debug.ExceptionReporter' DEFAULT_EXCEPTION_REPORTER_FILTER

'django.views.debug.SafeExceptionReporterFilter'

DEFAULT_FILE_STORAGE

'django.core.files.storage.FileSystemStorage'

DEFAULT_FROM_EMAIL

'webmaster@localhost'

DEFAULT_HASHING_ALGORITHM

'sha256'\n55566 e.backends.django.DjangoTemplates',   'DIRS': [PosixPath('/app/templates')],   'OPTIONS': {'context_processors': ['django.template.context_processors.debug',                                      'django.template.context_processors.request',                                      'django.contrib.auth.context_processors.auth',                                      'django.contrib.messages.context_processors.messages']}}]

TEST_NON_SERIALIZED_APPS

[]

TEST_RUNNER<\n57968

'F Y'

You\u00e2\u0080\u0099re seeing this error because you have DEBUG = True in your Django settings file. Change that to False, and Django will display a standard page generated by the handler for this status code.

\n--- template\n2403 text-decoration:none; } .user div.commands a { color: black; } #summary { background: #ffc; } #summary h2 { font-weight: normal; color: #666; } #explanation { background:#eee; } #template, #template-not-exist { background:#f6f6f6; } #template-not-exist ul { margin: 0 0 10px 20px; } #template-not-exist .postmortem-section { margin-bottom: 3px; } #unicode-hint { background:#eee; } #traceback { background:#eee; } #requestinfo { background:#f6f6f6; padding-left:120px; } #summary table { border:none; background:transparent; } #requestinfo h2, #requestinfo h3 { position:relative; margin-left:-100px; } #requestinfo h3 { margin-bottom:-1em; } \n2414 ation:none; } .user div.commands a { color: black; } #summary { background: #ffc; } #summary h2 { font-weight: normal; color: #666; } #explanation { background:#eee; } #template, #template-not-exist { background:#f6f6f6; } #template-not-exist ul { margin: 0 0 10px 20px; } #template-not-exist .postmortem-section { margin-bottom: 3px; } #unicode-hint { background:#eee; } #traceback { background:#eee; } #requestinfo { background:#f6f6f6; padding-left:120px; } #summary table { border:none; background:transparent; } #requestinfo h2, #requestinfo h3 { position:relative; margin-left:-100px; } #requestinfo h3 { margin-bottom:-1em; } .error { ba\n2462 black; } #summary { background: #ffc; } #summary h2 { font-weight: normal; color: #666; } #explanation { background:#eee; } #template, #template-not-exist { background:#f6f6f6; } #template-not-exist ul { margin: 0 0 10px 20px; } #template-not-exist .postmortem-section { margin-bottom: 3px; } #unicode-hint { background:#eee; } #traceback { background:#eee; } #requestinfo { background:#f6f6f6; padding-left:120px; } #summary table { border:none; background:transparent; } #requestinfo h2, #requestinfo h3 { position:relative; margin-left:-100px; } #requestinfo h3 { margin-bottom:-1em; } .error { background: #ffc; } .specific { color:#cc3300;\n2516 ry h2 { font-weight: normal; color: #666; } #explanation { background:#eee; } #template, #template-not-exist { background:#f6f6f6; } #template-not-exist ul { margin: 0 0 10px 20px; } #template-not-exist .postmortem-section { margin-bottom: 3px; } #unicode-hint { background:#eee; } #traceback { background:#eee; } #requestinfo { background:#f6f6f6; padding-left:120px; } #summary table { border:none; background:transparent; } #requestinfo h2, #requestinfo h3 { position:relative; margin-left:-100px; } #requestinfo h3 { margin-bottom:-1em; } .error { background: #ffc; } .specific { color:#cc3300; font-weight:bold; } h2 span.commands { font-size:\n41503 _MODULE_PATH

None

FORM_RENDERER

'django.forms.renderers.DjangoTemplates'

IGNORABLE_404_URLS

[]

INSTALLED_APPS

['django.contrib.admin',  'django.contrib.auth',  'django.contrib.contenttypes',  'django.contrib.sessions',  'django.contrib.messages',  'django.contrib.staticfiles',  'ssti_demo']None
                                    STATIC_URL           '/static/'
                                    TEMPLATES           [{'APP_DIRS': True,   'BACKEND': 'django.template.backends.django.DjangoTemplates',   'DIRS': [PosixPath('/app/templates')],   \n\u2026[truncated, 20841 bytes total \u2014 narrow with head/tail/grep]\n===== /\nHTTP/1.1 200 OK\r\nDate: Mon, 29 Jun 2026 13:14:20 GMT\r\nServer: WSGIServer/0.2 CPython/3.9.25\r\nContent-Type: text/html; charset=utf-8\r\nX-Frame-Options: DENY\r\nContent-Length: 425\r\nX-Content-Type-Options: nosniff\r\nReferrer-Policy: same-origin\r\n\r\n\n\n\n    \n    \n    SSTI Demo\n\n\n    SSTI Demo
\n    \n        Enter your name:\n        \n        \n    
\n\n\n\n\n===== /robots.txt\nHTTP/1.1 404 Not Found\r\nDate: Mon, 29 Jun 2026 13:14:20 GMT\r\nServer: WSGIServer/0.2 CPython/3.9.25\r\nContent-Type: text/html\r\nX-Frame-Options: DENY\r\nContent-Length: 2196\r\nX-Content-Type-Options: nosniff\r\nReferrer-Policy: same-origin\r\n\r\n\n\n\n  \n  Page not found at /robots.txt\n  \n  \n\n\n  \n    Page not found (404)
\n    \n      \n        \n        \n      \n      \n        \n        \n      \n      \n    Request Method: GET
Request URL: http://localhost/robots.txt
\n  
\n  \n    \n      \n      Using the URLconf defined in ssti_demo.urls,\n      Django tried these URL patterns, in this order:\n      
\n      \n        \n          \n            \n                admin/\n                \n            \n          
\n        \n          \n            \n                greet/\n                \n            \n          
\n        \n          \n            \n                \n                \n            \n          
\n        \n      
\n      \n        \n\n===== /api\nHTTP/1.1 404 Not Found\r\nDate: Mon, 29 Jun 2026 13:14:20 GMT\r\nServer: WSGIServer/0.2 CPython/3.9.25\r\nContent-Type: text/html\r\nX-Frame-Options: DENY\r\nContent-Length: 2175\r\nX-Content-Type-Options: nosniff\r\nReferrer-Policy: same-origin\r\n\r\n\n\n\n  \n  Page not found at /api\n  \n  \n\n\n  
\n    Page not found (404)
\n    \n      \n        \n        \n      \n      \n        \n        \n      \n      \n    Request Method: GET
Request URL: http://localhost/api
\n  
\n  \n    \n      \n      Using the URLconf defined in ssti_demo.urls,\n      Django tried these URL patterns, in this order:\n      
\n      \n        \n          \n            \n                admin/\n                \n            \n          
\n        \n          \n            \n                greet/\n                \n            \n          
\n        \n          \n            \n                \n                \n            \n          
\n        \n      
\n      \n        \n\n===== /admin\nHTTP/1.1 301 Moved Permanently\r\nDate: Mon, 29 Jun 2026 13:14:20 GMT\r\nServer: WSGIServer/0.2 CPython/3.9.25\r\nContent-Type: text/html; charset=utf-8\r\nLocation: /admin/\r\nContent-Length: 0\r\nX-Content-Type-Options: nosniff\r\nReferrer-Policy: same-origin\r\n\r\n\n===== /debug\nHTTP/1.1 404 Not Found\r\nDate: Mon, 29 Jun 2026 13:14:20 GMT\r\nServer: WSGIServer/0.2 CPython/3.9.25\r\nContent-Type: text/html\r\nX-Frame-Options: DENY\r\nContent-Length: 2181\r\nX-Content-Type-Options: nosniff\r\nReferrer-Policy: same-origin\r\n\r\n\n\n\n  \n  Page not found at /debug\n  \n  \n\n\n  
\n    Page not found (404)
\n    \n      \n        \n        \n      \n      \n        \n        \n      \n      \n    Request Method: GET
Request URL: http://localhost/debug
\n  
\n  \n    \n      \n      Using the URLconf defined in ssti_demo.urls,\n      Django tried these URL patterns, in this order:\n      
\n      \n        \n          \n            \n                admin/\n                \n            \n          
\n        \n          \n            \n                greet/\n                \n            \n          
\n        \n          \n            \n                \n                \n            \n          
\n        \n      
\n      \n        \n\n===== /healthz\nHTTP/1.1 404 Not Found\r\nDate: Mon, 29 Jun 2026 13:14:20 GMT\r\nServer: WSGIServer/0.2 CPython/3.9.25\r\nContent-Type: text/html\r\nX-Frame-Options: DENY\r\nContent-Length: 2187\r\nX-Content-Type-Options: nosniff\r\nReferrer-Policy: same-origin\r\n\r\n\n\n\n  \n  Page not found at /healthz\n  \n  \n\n\n  
\n    Page not found (404)
\n    \n      \n        \n        \n      \n      \n        \n        \n      \n      \n    Request Method: GET
Request URL: http://localhost/healthz
\n  
\n  \n    \n      \n      Using the URLconf defined in ssti_demo.urls,\n      Django tried these URL patterns, in this order:\n      
\n      \n        \n          \n            \n                admin/\n                \n            \n          
\n        \n          \n            \n                greet/\n                \n            \n          
\n        \n          \n            \n                \n                \n            \n          
\n        \n      
\n      \n        \n\n===== /login\nHTTP/1.1 404 Not Found\r\nDate: Mon, 29 Jun 2026 13:14:20 GMT\r\nServer: WSGIServer/0.2 CPython/3.9.25\r\nContent-Type: text/html\r\nX-Frame-Options: DENY\r\nContent-Length: 2181\r\nX-Content-Type-Options: nosniff\r\nReferrer-Policy: same-origin\r\n\r\n\n\n\n  \n  Page not found at /login\n  \n  \n\n\n  
\n    Page not found (404)
\n    \n      \n        \n        \n      \n      \n        \n        \n      \n      \n    Request Method: GET
Request URL: http://localhost/login
\n  
\n  \n    \n      \n      Using the URLconf defined in ssti_demo.urls,\n      Django tried these URL patterns, in this order:\n      
\n      \n        \n          \n            \n                admin/\n                \n            \n          
\n        \n          \n            \n                greet/\n                \n            \n          
\n        \n          \n            \n                \n                \n            \n          
\n        \n      
\n      \n        \n\n===== /search\nHTTP/1.1 404 Not Found\r\nDate: Mon, 29 Jun 2026 13:14:20 GMT\r\nServer: WSGIServer/0.2 CPython/3.9.25\r\nContent-Type: text/html\r\nX-Frame-Options: DENY\r\nContent-Length: 2184\r\nX-Content-Type-Options: nosniff\r\nReferrer-Policy: same-origin\r\n\r\n\n\n\n  \n  Page not found at /search\n  \n  \n\n\n  
\n    Page not found (404)
\n    \n      \n        \n        \n      \n      \n        \n        \n      \n      \n    Request Method: GET
Request URL: http://localhost/search
\n  
\n  \n    \n      \n      Using the URLconf defined in ssti_demo.urls,\n      Django tried these URL patterns, in this order:\n      
\n      \n        \n          \n            \n                admin/\n                \n            \n          
\n        \n          \n            \n                greet/\n                \n            \n          
\n        \n          \n            \n                \n                \n            \n          
\n        \n      
\n      \n        \n\n===== /sitemap.xml\nHTTP/1.1 404 Not Found\r\nDate: Mon, 29 Jun 2026 13:14:20 GMT\r\nServer: WSGIServer/0.2 CPython/3.9.25\r\nContent-Type: text/html\r\nX-Frame-Options: DENY\r\nContent-Length: 2199\r\nX-Content-Type-Options: nosniff\r\nReferrer-Policy: same-origin\r\n\r\n\n\n\n  \n  Page not found at /sitemap.xml\n  \n  \n\n\n  
\n    Page not found (404)
\n    \n      \n        \n        \n      \n      \n        \n        \n      \n      \n    Request Method: GET
Request URL: http://localhost/sitemap.xml
\n  
\n  \n    \n      \n      Using the URLconf defined in ssti_demo.urls,\n      Django tried these URL patterns, in this order:\n      
\n      \n        \n          \n            \n                admin/\n                \n            \n          
\n        \n          \n            \n                greet/\n                \n            \n          
\n        \n          \n            \n                \n                \n            \n          
\n        \n      
\n      \n        \n\n===== /static/app.js\nHTTP/1.1 404 Not Found\r\nDate: Mon, 29 Jun 2026 13:14:20 GMT\r\nServer: WSGIServer/0.2 CPython/3.9.25\r\nContent-Type: text/html\r\nConnection: close\r\n\r\n\n\n\n  \n  Page not found at /static/app.js\n  \n

DisallowedHost\n at /

Traceback \n Switch to copy-and-paste view\n

DisallowedHost at /

Request information

USER

GET

POST

FILES

SSTI Demo

Page not found (404)

Page not found (404)

Page not found (404)

Page not found (404)

Page not found (404)

Page not found (404)

Page not found (404)