title: What is the vulnerability ALLOWED_HOSTS is defending against?
body: <p>The example is from the Python Django framework but is applicable to all web applications.  How does the <a href="https://docs.djangoproject.com/en/dev/ref/settings/#allowed-hosts" rel="noreferrer"><code>ALLOWED_HOSTS</code> setting</a> protect your site and users, i.e. if <code>ALLOWED_HOSTS</code> was set to <code>"*"</code> how would a malicious user go about "poisoning caches and password reset emails with links to malicious hosts"?</p>
  
  <blockquote>
    <p>ALLOWED_HOSTS Default: [] (Empty list)</p>
    
    <p>A list of strings representing the host/domain names that this Django
    site can serve. This is a security measure to prevent an attacker from
    poisoning caches and password reset emails with links to malicious
    hosts by submitting requests with a fake HTTP Host header, which is
    possible even under many seemingly-safe web server configurations.</p>
    
    <p>Values in this list can be fully qualified names (e.g.
    'www.example.com'), in which case they will be matched against the
    request’s Host header exactly (case-insensitive, not including port).
    A value beginning with a period can be used as a subdomain wildcard:
    '.example.com' will match example.com, www.example.com, and any other
    subdomain of example.com. A value of '*' will match anything; in this
    case you are responsible to provide your own validation of the Host
    header (perhaps in a middleware; if so this middleware must be listed
    first in MIDDLEWARE_CLASSES).</p>
  </blockquote>