Warning: This is a simple server for use in testing or…

Error message

Warning: This is a simple server for use in testing or debugging Angular applications
locally. It hasn't been reviewed for security issues.

Binding this server to an open connection can result in compromising your application or
computer. Using a different host than the one passed to the "--host" flag might result in
websocket connection issues. You might need to use "--disable-host-check" if that's the
case.

What it means

Security warning printed by dev-server initialization when the server binds to a non-loopback host without --disable-host-check. The dev server is a local development tool not hardened for public exposure; binding it to an open interface risks exposing your machine, and mismatched hosts can break WebSocket HMR connections.

Solutions

If serving externally is required, explicitly add `--disable-host-check` after understanding the risk.
Otherwise bind to localhost/127.0.0.1 to silence the warning and stay safe.
For device testing, prefer `ng serve --host 0.0.0.0 --disable-host-check` on trusted networks only.
For proxy setups, configure the allowed hosts properly instead of ignoring host checks blindly.

Example fix

// before
ng serve --host 0.0.0.0
// after
ng serve --host 0.0.0.0 --disable-host-check  // trusted network only
// or
ng serve --host localhost

Defensive patterns

Strategy: validation

Validate before calling

const host = options.host ?? 'localhost';
const isLoopback = host === 'localhost' || /^127\.\d+\.\d+\.\d+$/.test(host);
if (!isLoopback && !options.disableHostCheck) {
  console.warn('Binding to a non-loopback host without --disable-host-check; add disableHostCheck or use localhost.');
}

Type guard

function isSafeHost(o: { host?: string; disableHostCheck?: boolean }): boolean {
  const h = o.host ?? 'localhost';
  return o.disableHostCheck === true || h === 'localhost' || /^127\.\d+\.\d+\.\d+$/.test(h);
}

Prevention

Bind dev servers to localhost unless external access is explicitly needed.
Never run dev servers exposed to the internet; use previews/staging for sharing.
Combine 0.0.0.0 binding with --disable-host-check only on trusted networks.

When it happens

Trigger: `normalizedOptions.host` matches neither /^127\.d+.d+.d+/ nor 'localhost' while disableHostCheck is falsy — e.g. host set to 0.0.0.0, a LAN IP, or a custom hostname.

Common situations: Testing on physical devices via LAN IP; Docker containers binding to 0.0.0.0; enterprise proxies requiring a public host, where HMR websockets then fail.

Related errors

AI-assisted analysis of angular/angular-cli@bb72145f9a (2026-08-30). Data as JSON: /api/errors/d07e2a135861d9c2. Report an issue: GitHub.

Appendix: source

Thrown at packages/angular_devkit/build_angular/src/builders/dev-server/builder.ts:176

) {
  // Purge old build disk cache.
  await purgeStaleBuildCache(context);

  const normalizedOptions = await normalizeOptions(context, projectName, initialOptions);
  const builderName = builderSelector(
    {
      builderName: await context.getBuilderNameForTarget(normalizedOptions.buildTarget),
      forceEsbuild: !!normalizedOptions.forceEsbuild,
    },
    context.logger,
  );

  if (
    !normalizedOptions.disableHostCheck &&
    !/^127\.\d+\.\d+\.\d+/g.test(normalizedOptions.host) &&
    normalizedOptions.host !== 'localhost'
  ) {
    context.logger.warn(`
Warning: This is a simple server for use in testing or debugging Angular applications
locally. It hasn't been reviewed for security issues.

Binding this server to an open connection can result in compromising your application or
computer. Using a different host than the one passed to the "--host" flag might result in
websocket connection issues. You might need to use "--disable-host-check" if that's the
case.
    `);
  }

  if (normalizedOptions.disableHostCheck) {
    context.logger.warn(
      'Warning: Running a server with --disable-host-check is a security risk. ' +
        'See https://medium.com/webpack/webpack-dev-server-middleware-security-issues-1489d950874a for more information.',
    );
  }

  normalizedOptions.port = await checkPort(normalizedOptions.port, normalizedOptions.host);

View on GitHub (pinned to bb72145f9a)