angular/angular-cli · warning

Warning: This is a simple server for use in testing or debu

Error message

Warning: This is a simple server for use in testing or debugging Angular applications
locally. It hasn't been reviewed for security issues.

Binding this server to an open connection can result in compromising your application or
computer. Using a different host than the one passed to the "--host" flag might result in
websocket connection issues. You might need to use "--disable-host-check" if that's the
case.
    

What it means

Security warning printed by dev-server initialization when the server binds to a non-loopback host without --disable-host-check. The dev server is a local development tool not hardened for public exposure; binding it to an open interface risks exposing your machine, and mismatched hosts can break WebSocket HMR connections.

Source

Thrown at packages/angular_devkit/build_angular/src/builders/dev-server/builder.ts:176

) {
  // Purge old build disk cache.
  await purgeStaleBuildCache(context);

  const normalizedOptions = await normalizeOptions(context, projectName, initialOptions);
  const builderName = builderSelector(
    {
      builderName: await context.getBuilderNameForTarget(normalizedOptions.buildTarget),
      forceEsbuild: !!normalizedOptions.forceEsbuild,
    },
    context.logger,
  );

  if (
    !normalizedOptions.disableHostCheck &&
    !/^127\.\d+\.\d+\.\d+/g.test(normalizedOptions.host) &&
    normalizedOptions.host !== 'localhost'
  ) {
    context.logger.warn(`
Warning: This is a simple server for use in testing or debugging Angular applications
locally. It hasn't been reviewed for security issues.

Binding this server to an open connection can result in compromising your application or
computer. Using a different host than the one passed to the "--host" flag might result in
websocket connection issues. You might need to use "--disable-host-check" if that's the
case.
    `);
  }

  if (normalizedOptions.disableHostCheck) {
    context.logger.warn(
      'Warning: Running a server with --disable-host-check is a security risk. ' +
        'See https://medium.com/webpack/webpack-dev-server-middleware-security-issues-1489d950874a for more information.',
    );
  }

  normalizedOptions.port = await checkPort(normalizedOptions.port, normalizedOptions.host);

View on GitHub (pinned to bb72145f9a)

Solutions

1. If serving externally is required, explicitly add `--disable-host-check` after understanding the risk.
2. Otherwise bind to localhost/127.0.0.1 to silence the warning and stay safe.
3. For device testing, prefer `ng serve --host 0.0.0.0 --disable-host-check` on trusted networks only.
4. For proxy setups, configure the allowed hosts properly instead of ignoring host checks blindly.

Example fix

// before
ng serve --host 0.0.0.0
// after
ng serve --host 0.0.0.0 --disable-host-check  // trusted network only
// or
ng serve --host localhost

const host = options.host ?? 'localhost';
const isLoopback = host === 'localhost' || /^127\.\d+\.\d+\.\d+$/.test(host);
if (!isLoopback && !options.disableHostCheck) {
  console.warn('Binding to a non-loopback host without --disable-host-check; add disableHostCheck or use localhost.');
}

function isSafeHost(o: { host?: string; disableHostCheck?: boolean }): boolean {
  const h = o.host ?? 'localhost';
  return o.disableHostCheck === true || h === 'localhost' || /^127\.\d+\.\d+\.\d+$/.test(h);
}

When it happens

Trigger: `normalizedOptions.host` matches neither /^127\.d+.d+.d+/ nor 'localhost' while disableHostCheck is falsy — e.g. host set to 0.0.0.0, a LAN IP, or a custom hostname.

Common situations: Testing on physical devices via LAN IP; Docker containers binding to 0.0.0.0; enterprise proxies requiring a public host, where HMR websockets then fail.

Related errors

• Access denied: path '${path}' is outside allowed roots.
• Access denied: glob pattern '${pattern}' contains path trave
• Workspace path is outside the allowed MCP roots: ${workspace
• Workspace path is outside the allowed MCP roots: ${workspace
• The current directory resolves to a workspace outside the al

AI-assisted analysis of angular/angular-cli@bb72145f9a (2026-08-30). Data as JSON: /api/errors/d07e2a135861d9c2. Report an issue: GitHub.