angular/angular-cli · warning

Allowing all hosts via "*" is a security risk. This configur

Error message

Allowing all hosts via "*" is a security risk. This configuration should only be used when validation for "Host" and "X-Forwarded-Host" headers is performed in another layer, such as a load balancer or reverse proxy. For more information see: https://angular.dev/best-practices/security#preventing-server-side-request-forgery-ssrf

What it means

Angular SSR's app engine computes the set of allowed `Host` values for SSRF protection. If `allowedHosts` contains the wildcard `"*"`, host validation is effectively disabled, so the engine warns that this is a security risk unless Host/X-Forwarded-Host validation happens in another layer (load balancer, reverse proxy).

Source

Thrown at packages/angular/ssr/src/app-engine.ts:128

   * A cache that holds entry points, keyed by their potential locale string.
   */
  private readonly entryPointsCache = new Map<string, Promise<EntryPointExports>>();

  /**
   * Creates a new instance of the Angular server application engine.
   * @param options Options for the Angular server application engine.
   */
  constructor(options?: AngularAppEngineOptions) {
    this.allowedHosts = this.getAllowedHosts(options);
    this.trustProxyHeaders = normalizeTrustProxyHeaders(options?.trustProxyHeaders);
  }

  private getAllowedHosts(options: AngularAppEngineOptions | undefined): ReadonlySet<string> {
    const allowedHosts = new Set([...(options?.allowedHosts ?? []), ...this.manifest.allowedHosts]);

    if (allowedHosts.has('*')) {
      // eslint-disable-next-line no-console
      console.warn(
        'Allowing all hosts via "*" is a security risk. This configuration should only be used when ' +
          'validation for "Host" and "X-Forwarded-Host" headers is performed in another layer, such as a load balancer or reverse proxy. ' +
          'For more information see: https://angular.dev/best-practices/security#preventing-server-side-request-forgery-ssrf',
      );
    }

    return allowedHosts;
  }

  /**
   * Handles an incoming HTTP request by serving prerendered content, performing server-side rendering,
   * or delivering a static file for client-side rendered routes based on the `RenderMode` setting.
   *
   * @param request - The HTTP request to handle.
   * @param requestContext - Optional context for rendering, such as metadata associated with the request.
   * @returns A promise that resolves to the resulting HTTP response object, or `null` if no matching Angular route is found.
   *
   * @remarks A request to `https://www.example.com/page/index.html` will serve or render the Angular route

View on GitHub (pinned to bb72145f9a)

Solutions

1. Replace `"*"` with the explicit list of hosts your app serves (e.g. `['example.com', 'www.example.com']`).
2. If `"*"` is truly needed, confirm Host/X-Forwarded-Host validation is enforced upstream (load balancer or reverse proxy allowlist) and document it.
3. Keep dev-only wildcard in a non-production manifest/options branch (e.g. environment-based configuration).

Example fix

// before
new AngularAppEngine({ allowedHosts: ['*'] })
// after
new AngularAppEngine({ allowedHosts: ['example.com', 'www.example.com'] })

// validate allowedHosts before constructing the engine
const hosts = [...(options?.allowedHosts ?? []), ...manifest.allowedHosts];
if (hosts.includes('*')) throw new Error('Remove "*" from allowedHosts in production; list explicit hosts.');

When it happens

Trigger: Constructing `AngularAppEngine` / starting SSR where either the `AngularAppEngineOptions.allowedHosts` option or the server manifest's `allowedHosts` includes `"*"`.

Common situations: Copy-pasted dev configs promoted to production, attempts to make a multi-domain deployment work quickly, or `allowedHosts: ['*']` left in `app.config.server.ts` / server bootstrap options.

Related errors

• "${TRUST_ALL_PROXY_HEADERS}" is not allowed as a value for t
• "${header}" is not a valid proxy header. Trusted proxy heade
• A module or bootstrap option must be provided.
• Configuration error: found 'withAppShell()' without 'withRou
• URL with hostname "${hostname}" is not allowed.

AI-assisted analysis of angular/angular-cli@bb72145f9a (2026-08-30). Data as JSON: /api/errors/e9139e840a28ca17. Report an issue: GitHub.