angular/angular-cli · error · Error

URL with hostname "${hostname}" is not allowed.

Error message

URL with hostname "${hostname}" is not allowed.

What it means

validateUrl guards the Angular SSR server against host-header attacks / DNS rebinding by checking that the incoming request URL's hostname is in the configured allowed-hosts allowlist. If the hostname is not allowed, the request is rejected rather than rendered.

Source

Thrown at packages/angular/ssr/src/utils/validation.ts:85

): void {
  validateHeaders(request, allowedHosts, disableHostCheck);

  if (!disableHostCheck) {
    validateUrl(new URL(request.url), allowedHosts);
  }
}

/**
 * Validates that the hostname of a given URL is allowed.
 *
 * @param url - The URL object to validate.
 * @param allowedHosts - A set of allowed hostnames.
 * @throws Error if the hostname is not in the allowlist.
 */
export function validateUrl(url: URL, allowedHosts: ReadonlySet<string>): void {
  const { hostname } = url;
  if (!isHostAllowed(hostname, allowedHosts)) {
    throw new Error(`URL with hostname "${hostname}" is not allowed.`);
  }
}

/**
 * Sanitizes the proxy headers of a request by removing unallowed `X-Forwarded-*` headers.
 * If no headers need to be removed, the original request is returned unchanged.
 *
 * @param request - The incoming `Request` object to sanitize.
 * @param trustProxyHeaders - A set of allowed proxy headers.
 * @returns The sanitized request, or the original request if no changes were needed.
 */
export function sanitizeRequestHeaders(
  request: Request,
  trustProxyHeaders: ReadonlySet<string>,
): Request {
  let headersDeleted = false;
  const headers = new Headers();

View on GitHub (pinned to bb72145f9a)

Solutions

1. Add the hostname to the SSR allowedHosts configuration ('allowedHosts' in the server config / angular.json ssr options).
2. Access the app via an allowlisted hostname instead of an IP or ad-hoc tunnel host.
3. Check whether a proxy strips or rewrites the Host/X-Forwarded-Host header and configure it to forward the correct host.

Example fix

// before (server config)
ssr: { allowedHosts: ['example.com'] }
// after
ssr: { allowedHosts: ['example.com', 'www.example.com', 'localhost', '127.0.0.1'] }

const url = new URL(request.url);
if (!allowedHosts.has(url.hostname)) {
  return new Response('Forbidden', { status: 403 });
}
await render(request);

function isHostAllowed(hostname: string, allowedHosts: ReadonlySet<string>): boolean {
  return allowedHosts.has(hostname.toLowerCase());
}

try {
  await render(request);
} catch (e) {
  if (e instanceof Error && e.message.includes('is not allowed.')) {
    return new Response('Forbidden: host not allowed', { status: 403 });
  } throw e;
}

When it happens

Trigger: A request whose URL hostname (or a forwarded-host header resolved by render/validateRequest) is not present in the allowedHosts set — e.g. requesting via an IP address, localhost vs production domain mismatch, or an unexpected Host/X-Forwarded-Host header.

Common situations: Accessing the dev/prod server via 127.0.0.1 or an internal hostname while allowedHosts lists only the public domain; adding a custom domain or load balancer without updating the allowlist; CDN/proxy rewriting the Host header; testing behind a tunnel (ngrok) hostname.

Related errors

• Header "${headerName}" with value "${headerValue}" is not al
• Header "${headerName}" contains an invalid value and cannot
• Header "${headerName}" with value "${headerValue}" contains
• Header "forwarded" proto parameter must be either "http" or
• Header "x-forwarded-port" must be a numeric value.

AI-assisted analysis of angular/angular-cli@bb72145f9a (2026-08-30). Data as JSON: /api/errors/53e3ce44a0b465f4. Report an issue: GitHub.