angular/angular-cli · warning

Warning: Running a server with --disable-host-check is a sec

Error message

Warning: Running a server with --disable-host-check is a security risk. See https://medium.com/webpack/webpack-dev-server-middleware-security-issues-1489d950874a for more information.

What it means

This is a warning emitted by the Angular dev-server builder when the `disableHostCheck` option is true. Disabling the host check makes webpack-dev-server accept connections with any Host header, which allows DNS-rebinding attacks where a malicious website can reach your dev server and execute code in the context of your machine. The CLI warns because you have explicitly opted out of a security protection.

Source

Thrown at packages/angular_devkit/build_angular/src/builders/dev-server/builder.ts:188

  if (
    !normalizedOptions.disableHostCheck &&
    !/^127\.\d+\.\d+\.\d+/g.test(normalizedOptions.host) &&
    normalizedOptions.host !== 'localhost'
  ) {
    context.logger.warn(`
Warning: This is a simple server for use in testing or debugging Angular applications
locally. It hasn't been reviewed for security issues.

Binding this server to an open connection can result in compromising your application or
computer. Using a different host than the one passed to the "--host" flag might result in
websocket connection issues. You might need to use "--disable-host-check" if that's the
case.
    `);
  }

  if (normalizedOptions.disableHostCheck) {
    context.logger.warn(
      'Warning: Running a server with --disable-host-check is a security risk. ' +
        'See https://medium.com/webpack/webpack-dev-server-middleware-security-issues-1489d950874a for more information.',
    );
  }

  normalizedOptions.port = await checkPort(normalizedOptions.port, normalizedOptions.host);

  return {
    builderName,
    normalizedOptions,
  };
}

interface BuilderSelectorInfo {
  builderName: string;
  forceEsbuild: boolean;
}

View on GitHub (pinned to bb72145f9a)

Solutions

1. Remove `--disable-host-check` and instead add your specific host with the `--allowed-hosts` option (webpack-dev-server 5+) or `allowedHosts` in the dev-server options
2. Access the dev server via localhost/127.0.0.1 so the default host check passes
3. If you must disable it, only do so on a trusted network and never expose the dev server publicly
4. Suppress awareness: accept the warning only in ephemeral/sandboxed environments

Example fix

// before
ng serve --disable-host-check
// after
ng serve --allowed-hosts myapp.dev.example.com

// angular.json serve options pre-check
const dangerous = options.disableHostCheck === true;
if (dangerous) {
  console.warn('Host check disabled: ensure the dev server is not exposed to untrusted networks; prefer --allowed-hosts <host>.');
}

function isHostCheckDisabled(o: { disableHostCheck?: boolean }): boolean {
  return o?.disableHostCheck === true;
}

When it happens

Trigger: Running `ng serve --disable-host-check` or setting `"disableHostCheck": true` in the dev-server target options of angular.json; emitted from `initialize()` during server startup, before the port check.

Common situations: Developers testing inside Docker containers or VMs, accessing the dev server via a forwarded hostname or IP not in `allowedHosts`, or using preview/proxy URLs (e.g. ngrok, code-server) and reaching for the quickest fix to 'Invalid Host header'.

Related errors

• Access denied: path '${path}' is outside allowed roots.
• Access denied: glob pattern '${pattern}' contains path trave
• Workspace path is outside the allowed MCP roots: ${workspace
• Workspace path is outside the allowed MCP roots: ${workspace
• The current directory resolves to a workspace outside the al

AI-assisted analysis of angular/angular-cli@bb72145f9a (2026-08-30). Data as JSON: /api/errors/1b3d2ae65c5faa75. Report an issue: GitHub.