Registry / web-framework / django-allow-cidr

django-allow-cidr

library0.8.0pypypi✓ verified 24d ago

django-allow-cidr is a Django Middleware that extends the functionality of Django's `ALLOWED_HOSTS` setting to support CIDR IP ranges. It allows developers to specify IP networks (e.g., '192.168.1.0/24') alongside regular hostnames, which is particularly useful for health checks or internal network access. The current version is 0.8.0, with releases occurring periodically to support new Django and Python versions.

web-framework auth-security

pip install django-allow-cidr

github ↗package ↗

INSTALL

IMPORT

SIG · DJANGO-ALLOW-CIDR

django-allow-cidr

web-frameworkpythonv0.8.0

Install

3.4s avg

Import

710ms

Disk

66MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v0.8.0 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.754s · 66.3MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 3.4s · import 0.666s · 67MB

66MB installed

● package 66MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

AllowCIDRMiddleware

✓ from allow_cidr.middleware import AllowCIDRMiddleware

To use django-allow-cidr, install it via pip and then add `AllowCIDRMiddleware` to the very beginning of your `MIDDLEWARE` settings. Define your allowed CIDR ranges in the `ALLOWED_CIDR_NETS` setting in your `settings.py`. Note that if `ALLOWED_CIDR_NETS` is defined, the middleware will internally set `ALLOWED_HOSTS` to `['*']` and take over host header validation.

import os SECRET_KEY = os.environ.get('DJANGO_SECRET_KEY', 'a-very-secret-key-for-development') DEBUG = True ALLOWED_HOSTS = [ 'localhost', '127.0.0.1', # Other hostnames will still work ] # Define CIDR ranges for allowed hosts ALLOWED_CIDR_NETS = [ '192.168.1.0/24', '10.0.0.0/8', '::1/128' # IPv6 example ] MIDDLEWARE = [ 'allow_cidr.middleware.AllowCIDRMiddleware', 'django.middleware.security.SecurityMiddleware', 'django.contrib.sessions.middleware.SessionMiddleware', 'django.middleware.common.CommonMiddleware', 'django.middleware.csrf.CsrfViewMiddleware', 'django.contrib.auth.middleware.AuthenticationMiddleware', 'django.contrib.messages.middleware.MessageMiddleware', 'django.middleware.clickjacking.XFrameOptionsMiddleware', ]

Debug

Known issues

breakingVersion 0.8.0 dropped support for Python versions older than 3.9 and Django versions earlier than 4.1.

fix

Upgrade to Python 3.9+ and Django 4.1+ before upgrading django-allow-cidr to 0.8.0.

affects: <0.8.0

breakingVersion 0.6.0 dropped support for Python 3.6. Users on Python 3.6 must upgrade their Python version before updating to 0.6.0 or newer.

fix

Ensure your project runs on Python 3.7 or newer before upgrading to django-allow-cidr 0.6.0+.

affects: <0.6.0

gotchaThe `AllowCIDRMiddleware` *must* be the first middleware in your `MIDDLEWARE` tuple/list. Incorrect placement may lead to Django's built-in `HostHeader` validation rejecting requests before `django-allow-cidr` can process them.

fix

Always place `'allow_cidr.middleware.AllowCIDRMiddleware'` at the very top of your `MIDDLEWARE` setting.

affects: All

gotchaIf `ALLOWED_CIDR_NETS` is defined and has values, `django-allow-cidr` will internally set Django's `ALLOWED_HOSTS` to `['*']` and handle host header validation itself. While other `ALLOWED_HOSTS` entries will still be considered by the middleware, this internal change is important to understand for debugging.

fix

Configure `ALLOWED_HOSTS` and `ALLOWED_CIDR_NETS` as usual. Be aware that `ALLOWED_HOSTS = ['*']` becomes the effective Django setting at runtime when `ALLOWED_CIDR_NETS` is in use, with `django-allow-cidr` enforcing the actual host restrictions.

affects: All

deprecatedPrior to version 0.5.0, `django-allow-cidr` depended on the `netaddr` library. Version 0.5.0 replaced this dependency with Python 3's built-in `ipaddress` module. While not directly breaking for most users, those relying on `netaddr` being pulled in as a transitive dependency should be aware of this change.

fix

Ensure your environment is running Python 3.3+ (where `ipaddress` was introduced). No action is typically needed unless you had specific `netaddr` version requirements that are no longer met.

affects: <0.5.0

Errors

Common errors & fixes

ModuleNotFoundError: No module named 'allow_cidr'

The `django-allow-cidr` package is either not installed, or its middleware path is incorrectly specified in Django's `MIDDLEWARE` setting.

fix

Ensure the package is installed using `pip install django-allow-cidr` and that the middleware is correctly added to your `settings.py` as `'allow_cidr.middleware.AllowCIDRMiddleware'`.

django.core.exceptions.DisallowedHost: Invalid HTTP_HOST header: 'X.X.X.X'. You may need to add 'X.X.X.X' to ALLOWED_HOSTS.

The `django-allow-cidr` middleware is not correctly configured or positioned, or the `ALLOWED_CIDR_NETS` setting does not include the requesting IP address, causing Django's built-in host validation to reject the request.

fix

Verify that `'allow_cidr.middleware.AllowCIDRMiddleware'` is the *first* middleware listed in your `MIDDLEWARE` setting and that `ALLOWED_CIDR_NETS` in `settings.py` contains the appropriate CIDR range for the requesting IP (e.g., `ALLOWED_CIDR_NETS = ['192.168.1.0/24']`).

ValueError: 'invalid_cidr_string' does not appear to be an IPv4 or IPv6 network.

An entry in your `ALLOWED_CIDR_NETS` setting is not a valid CIDR IP network string, which causes the underlying `ipaddress` library to raise an error during parsing.

fix

Review your `ALLOWED_CIDR_NETS` list in `settings.py` and ensure all strings are in a correct CIDR format (e.g., `'192.168.1.0/24'` or `'2001:db8::/32'`).

Upgrade

Version history

0.8.0latest on PyPI · released Apr 8, 2025

Audit

Dependencies

DjangorequiredCore framework dependency.

ipaddressrequiredUsed for IP address and network manipulation; included in Python's standard library since 3.3.

Agent activity

15 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/mozmeao/django-allow-cidr ↗

packagehttps://pypi.org/project/django-allow-cidr/ ↗