ALLOWED_HOSTS setting missing

In Django, you need to properly set the ALLOWED_HOSTS setting when DEBUG = False. This is a security mechanism. It prevents attackers from poisoning caches or password reset emails with links to malicious hosts by submitting requests with a fake HTTP Host header, which is possible even under many seemingly-safe web server configurations.

Anti-Pattern

ALLOWED_HOSTS not set or empty, when DEBUG = False.

""" settings.py """

DEBUG = False
# ...
ALLOWED_HOSTS = []

Best practice

Make sure, an appropriate host is set in ALLOWED_HOSTS, whenever DEBUG = False.

DEBUG = False
# ...
ALLOWED_HOSTS = ['djangoproject.com']