ALLOWED_HOSTS hard to configure

[niccokunzmann]

I do not know what is going on but when I (behind a reverse-proxy) set which hosts are allowed, then I see this error message when I access the domain:

The error message claims that I access the service from another hostname but actually this is the only hostname I allow.

For now, this can be seen here: http://test.open-web-calendar.hosted.quelltext.eu/

@vmario89 Do you have any thoughts on this one?

---

We're using Polar.sh so you can upvote and help fund this issue. We receive the funding once the issue is completed & confirmed by you. Thank you in advance for helping prioritize & fund our work.

[niccokunzmann]

What I see for now:

open-web-calendar-test-1  | Client IP: 172.20.0.3
open-web-calendar-test-1  | Request HOST: test.open-web-calendar.hosted.quelltext.eu
open-web-calendar-test-1  | Real HOST: x-nginx-proxy-manager-1.x_owc-net
open-web-calendar-test-1  | Invalid HOST, falling back to Client IP check
open-web-calendar-test-1  | Invalid Client IP, request was not permitted
open-web-calendar-test-1  | 172.20.0.3 - - [10/May/2024 22:38:50] "GET / HTTP/1.1" 403 -

With this source code: https://github.com/niccokunzmann/flask-allowedhosts/tree/main/flask_allowedhosts

There are different checks made. This one uses a different host name: I guess behind a proxy server, the hostname is changed and that makes limiting the requests a bit useless as only certain requests come though.

@vmario89 What are your thoughts on this? Could you run the hack from #366 on https://open-web-calendar.hosted.quelltext.eu or was this on a self-hosted instance?