angular/angular-cli · warning

Received "${key}" header but "trustProxyHeaders" was not set

Error message

Received "${key}" header but "trustProxyHeaders" was not set up to allow it.
For more information, see https://angular.dev/best-practices/security#configuring-trusted-proxy-headers

What it means

Angular SSR sanitizes incoming request headers to prevent header-based SSRF/proxy spoofing. `Forwarded` and `X-Forwarded-*` headers are stripped unless `trustProxyHeaders` explicitly allows them; when such a header arrives and is not allowed, it warns and deletes the header from the sanitized request.

Source

Thrown at packages/angular/ssr/src/utils/validation.ts:109

 * If no headers need to be removed, the original request is returned unchanged.
 *
 * @param request - The incoming `Request` object to sanitize.
 * @param trustProxyHeaders - A set of allowed proxy headers.
 * @returns The sanitized request, or the original request if no changes were needed.
 */
export function sanitizeRequestHeaders(
  request: Request,
  trustProxyHeaders: ReadonlySet<string>,
): Request {
  let headersDeleted = false;
  const headers = new Headers();

  for (const [key, value] of request.headers) {
    const lowerKey = key.toLowerCase();
    const isProxyHeader = lowerKey === 'forwarded' || lowerKey.startsWith('x-forwarded-');
    if (isProxyHeader && !isProxyHeaderAllowed(lowerKey, trustProxyHeaders)) {
      // eslint-disable-next-line no-console
      console.warn(
        `Received "${key}" header but "trustProxyHeaders" was not set up to allow it.\n` +
          `For more information, see https://angular.dev/best-practices/security#configuring-trusted-proxy-headers`,
      );
      headersDeleted = true;
    } else {
      headers.set(key, value);
    }
  }

  return headersDeleted
    ? new Request(request, {
        headers,
      })
    : request;
}

/**
 * Validates a specific host header value against the allowed hosts.

View on GitHub (pinned to bb72145f9a)

Solutions

1. If the proxy is trusted, explicitly allow the headers in server config, e.g. `trustProxyHeaders: ['x-forwarded-host', 'x-forwarded-proto']`.
2. If not needed, do nothing — the header is safely stripped; configure the upstream proxy to not forward hop-by-hop headers.
3. Restrict the allowlist to only headers your app actually consumes (never blanket-allow when clients can reach the server directly).

Example fix

// before (server bootstrap)
bootstrapApplication(AppComponent, { ... }) // trustProxyHeaders unset
// after
bootstrapApplication(AppComponent, {
  providers: [provideServerRendering()],
  // or engine options:
});
// with AngularAppEngineOptions:
new AngularAppEngine({ trustProxyHeaders: ['x-forwarded-host', 'x-forwarded-proto'] })

// ensure every forwarded header your proxy sends is in the trust list
const PROXY_HEADERS = ['forwarded', 'x-forwarded-host', 'x-forwarded-proto', 'x-forwarded-for'];
const trusted = new Set(trustProxyHeaders ?? []);
const untrusted = PROXY_HEADERS.filter((h) => !trusted.has(h));
if (untrusted.length && DEPLOYED_BEHIND_PROXY) console.warn('Add to trustProxyHeaders:', untrusted);

When it happens

Trigger: A request reaches the SSR server carrying `Forwarded` or `X-Forwarded-*` headers (from a reverse proxy or a malicious client) while the server's `trustProxyHeaders` configuration does not include that specific header key.

Common situations: Deploying behind nginx/CloudFront/CDN that injects `X-Forwarded-For`/`X-Forwarded-Host` without configuring `trustProxyHeaders` in the Angular server options; local proxies like Vite dev proxy forwarding hop headers.

Related errors

• host value cannot be an array.
• Header "forwarded" proto parameter must be either "http" or
• Header "x-forwarded-port" must be a numeric value.
• Header "x-forwarded-proto" must be either "http" or "https".
• Header "x-forwarded-prefix" is invalid. It must start with a

AI-assisted analysis of angular/angular-cli@bb72145f9a (2026-08-30). Data as JSON: /api/errors/caf4ee27bb1f4922. Report an issue: GitHub.