angular/angular-cli · error · Error

"${TRUST_ALL_PROXY_HEADERS}" is not allowed as a value for t

Error message

"${TRUST_ALL_PROXY_HEADERS}" is not allowed as a value for the "trustProxyHeaders" option.

What it means

The `trustProxyHeaders` option accepts individual proxy header names, or the wildcard `*` meaning trust all. Angular SSR forbids passing `*` as an element within the list of header names in `normalizeTrustProxyHeaders` — the sentinel is only valid as the sole value meaning 'trust everything', so mixing it with named headers is rejected at construction/validation time.

Source

Thrown at packages/angular/ssr/src/utils/validation.ts:269

 * @param trustProxyHeaders The input `trustProxyHeaders` value.
 * @returns A `Set<string>` of normalized header names.
 */
export function normalizeTrustProxyHeaders(
  trustProxyHeaders: boolean | readonly string[] | undefined,
): ReadonlySet<string> {
  if (!trustProxyHeaders) {
    return new Set();
  }

  if (trustProxyHeaders === true) {
    return new Set([TRUST_ALL_PROXY_HEADERS]);
  }

  const normalizedTrustedProxyHeaders = new Set<string>();
  for (const header of trustProxyHeaders) {
    const lowerHeader = header.toLowerCase();
    if (lowerHeader === TRUST_ALL_PROXY_HEADERS) {
      throw new Error(
        `"${TRUST_ALL_PROXY_HEADERS}" is not allowed as a value for the "trustProxyHeaders" option.`,
      );
    }
    const isValid = lowerHeader === 'forwarded' || lowerHeader.startsWith('x-forwarded-');
    if (!isValid) {
      throw new Error(
        `"${header}" is not a valid proxy header. Trusted proxy headers must be "forwarded" or start with "x-forwarded-".`,
      );
    }
    normalizedTrustedProxyHeaders.add(lowerHeader);
  }

  return normalizedTrustedProxyHeaders;
}

/**
 * Parses the standard `Forwarded` header (RFC 7239).
 * It extracts the parameters from the first (leftmost) element in the header.

View on GitHub (pinned to bb72145f9a)

Solutions

Use `trustProxyHeaders: '*'` alone if you truly want to trust all proxy headers (not recommended).
Otherwise remove the `'*'` entry and list only the specific headers you trust, e.g. `['x-forwarded-host', 'x-forwarded-proto']`.
Only list headers your reverse proxy actually sets and controls.

Example fix

// before
new AngularServerApp({ trustProxyHeaders: ['*', 'x-forwarded-proto'] });
// after
new AngularServerApp({ trustProxyHeaders: ['x-forwarded-proto', 'x-forwarded-host'] });

Defensive patterns

Strategy: validation

Validate before calling

const headers = ['*', 'x-forwarded-proto'];
if (headers.includes('*') && headers.length > 1) throw new Error('Use "*" alone or list specific proxy headers');

Type guard

function isTrustProxyHeadersValid(v: string[] | '*'): boolean {
  return v === '*' || (Array.isArray(v) && !v.includes('*'));
}

Try / catch

try {
  const app = new AngularServerApp({ trustProxyHeaders: cfg.trustProxyHeaders });
} catch (e) {
  if ((e as Error).message.includes('trustProxyHeaders')) {
    throw new Error('Fix trustProxyHeaders config: "*" must be used alone.');
  }
  throw e;
}

Prevention

Prefer explicit header lists over the wildcard sentinel.
Validate the trustProxyHeaders config at app startup, not on first request.
Document that "*" is a standalone value in team config conventions.

When it happens

Trigger: Calling the SSR server API with `trustProxyHeaders: ['*', 'x-forwarded-proto']` or similar, where `*` appears alongside other header names.

Common situations: Copy-pasting config snippets; misunderstanding that `*` is a standalone value; migration from older configs that allowed any header names.

Understand the failure class

Background: "Invalid configuration value" and "Unsupported/Unknown setting value" errors: why libraries reject your config strings, numbers, and types — this error's family across 30 libraries.

Related errors

AI-assisted analysis of angular/angular-cli@bb72145f9a (2026-08-30). Data as JSON: /api/errors/697716f17d4eb617. Report an issue: GitHub.