Django Academy · 课时

DEBUG、SECRET_KEY 与 ALLOWED_HOSTS

正确设置危险配置项

DEBUG、SECRET_KEY 与 ALLOWED_HOSTS 是 CoddyKit 上的免费 Django Academy 课时。这是第 1 节课，共 4 节。你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。这是 Django Academy 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 Django Academy 课程共包含 4 节课。

本课时的部分内容尚未翻译，以英文显示。

Three Dangerous Settings

Three settings in settings.py can sink a production site if you get them wrong. Let us tame DEBUG, SECRET_KEY, and ALLOWED_HOSTS together. 🔒

What DEBUG Does

When DEBUG is True, Django shows detailed error pages with your code, settings, and traceback. That is gold in dev but a gift to attackers in production.

DEBUG = True

Turn DEBUG Off in Production

In production, set DEBUG to False so users see a generic 500 page instead of your internals. Never ship a live site with DEBUG on.

DEBUG = False

Meet SECRET_KEY

The SECRET_KEY is the seed Django uses to sign sessions, CSRF tokens, and password resets. Leak it and an attacker can forge any of them.

SECRET_KEY = "django-insecure-..."

Keep SECRET_KEY Secret

Never commit your real SECRET_KEY to git. Load it from an environment variable so the value lives outside your code.

import os
SECRET_KEY = os.environ["DJANGO_SECRET_KEY"]

Generate a Strong Key

Need a fresh SECRET_KEY? Django ships a helper that returns a long, random, hard-to-guess string for you to store securely.

from django.core.management.utils import get_random_secret_key
get_random_secret_key()

Why ALLOWED_HOSTS Exists

ALLOWED_HOSTS lists the domains your site is allowed to serve. It blocks HTTP Host header attacks that try to trick your app with a fake hostname.

Set Your Real Domains

Fill ALLOWED_HOSTS with the exact domains your site answers to. With DEBUG off, any request to an unlisted host gets a 400 error.

ALLOWED_HOSTS = ["example.com", "www.example.com"]

Avoid the Wildcard Trap

Setting ALLOWED_HOSTS to the wildcard accepts any host header and defeats the protection. Use it only for quick local tests, never in production.

ALLOWED_HOSTS = ["*"]

Drive It All From Env

The clean pattern is one source of truth: read DEBUG, SECRET_KEY, and hosts from environment variables so the same code runs safely everywhere.

DEBUG = os.environ.get("DEBUG", "0") == "1"

Let Django Warn You

Django can audit these settings for you. The check --deploy command flags an unsafe DEBUG, weak key, or open hosts before you ship.

python manage.py check --deploy

Quick Check

Time to test your instinct about production settings.

Recap: The Safe Trio

You locked down the basics: DEBUG off, a secret key kept out of git, and ALLOWED_HOSTS scoped to your domains. Run check --deploy and you are off to a safe start. 🎉

常见问题解答

「DEBUG、SECRET_KEY 与 ALLOWED_HOSTS」课时是免费的吗？

是的 — 「DEBUG、SECRET_KEY 与 ALLOWED_HOSTS」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 Django Academy 课程的其余内容，请升级到 CoddyKit PRO。 Django Academy 课程共包含 4 节课。

「DEBUG、SECRET_KEY 与 ALLOWED_HOSTS」这节课中我会学到什么？

正确设置危险配置项你通过在浏览器中直接运行的动手代码来练习 Django Academy，全天候 AI 导师会在你学习这节课的过程中回答你的问题。

学习 Django Academy 需要有经验吗？

无需任何先前经验。CoddyKit 上的 Django Academy 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。这是第 1 节课，共 4 节。

「DEBUG、SECRET_KEY 与 ALLOWED_HOSTS」课时需要多长时间？

大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。

我能在这节 Django Academy 课中编写并运行代码吗？

能。每节 Django Academy 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。

此课程中的所有课时

← 返回 Django Academy