{"record":{"id":"09425ae09f7b70a0","repo":"symfony/http-foundation","slug":"invalid-host-s","errorCode":null,"errorMessage":"Invalid Host \"%s\".","messagePattern":"Invalid Host \"(.+?)\"\\.","errorType":"exception","errorClass":"SuspiciousOperationException","httpStatus":400,"severity":"error","filePath":"Request.php","lineNumber":1216,"sourceCode":"    {\n        if ($this->isFromTrustedProxy() && $host = $this->getTrustedValues(self::HEADER_X_FORWARDED_HOST)) {\n            $host = $host[0];\n        } else {\n            $host = $this->headers->get('HOST') ?: $this->server->get('SERVER_NAME') ?: $this->server->get('SERVER_ADDR', '');\n        }\n\n        // trim and remove port number from host\n        // host is lowercase as per RFC 952/2181\n        $host = strtolower(preg_replace('/:\\d+$/', '', trim($host)));\n\n        // the host can come from the user (HTTP_HOST and depending on the configuration, SERVER_NAME too can come from the user)\n        if ($host && !self::isHostValid($host)) {\n            if (!$this->isHostValid) {\n                return '';\n            }\n            $this->isHostValid = false;\n\n            throw new SuspiciousOperationException(\\sprintf('Invalid Host \"%s\".', $host));\n        }\n\n        if (self::$trustedHostsLiterals || self::$trustedHostsRegexps) {\n            // to avoid host header injection attacks, you should provide a list of trusted host patterns\n\n            if (self::$trustedHosts) {\n                trigger_deprecation('symfony/http-foundation', '8.2', 'Populating the \"%s::$trustedHosts\" property is deprecated; it has no effect anymore.', self::class);\n            }\n\n            if (isset(self::$trustedHostsLiterals[$host])) {\n                return $host;\n            }\n\n            foreach (self::$trustedHostsRegexps as $regexp) {\n                if (preg_match($regexp, $host)) {\n                    return $host;\n                }\n            }","sourceCodeStart":1198,"sourceCodeEnd":1234,"githubUrl":"https://github.com/symfony/http-foundation/blob/5aea19cd678fa4140f6108406f1096de5e9ed6e4/Request.php#L1198-L1234","documentation":"Request::getHost() validates the Host header. If the host string fails isHostValid (contains invalid characters such as ':' port remnants, spaces, or control chars) the request throws SuspiciousOperationException('Invalid Host \"%s\".'), because a malformed Host header is a classic host-header-injection vector. This is the first check, distinct from the trusted-hosts check.","triggerScenarios":"A client sends Host: 'evil.com:8080/..' or any header with characters outside the allowed set (letters, digits, dots, dashes, brackets for IPv6); calling Request::create() with a URI whose host part is malformed; tampered proxies forwarding bogus Host values.","commonSituations":"Security scanners or attackers probing for host header injection / cache poisoning; misconfigured reverse proxies forwarding the raw Host; generating absolute URLs in emails from an attacker-controlled Host.","solutions":["Fix the client/proxy Host header value so it contains only a valid hostname.","Set framework.trusted_hosts (Request::setTrustedHosts([...])) so legitimate hosts pass and untrusted ones are rejected predictably.","At the web-server level, reject requests whose Host doesn't match your domain (e.g. nginx server_name enforcement).","Catch SuspiciousOperationException and return 400 instead of letting it bubble as 500."],"exampleFix":"// before (nginx forwarding anything)\nproxy_set_header Host $http_host;\n\n// after (enforce known host)\nif ($http_host !~* ^(app\\.example\\.com(:[0-9]+)?)$) { return 400; }\nproxy_set_header Host $http_host;","handlingStrategy":"try-catch","validationCode":"$host = $request->headers->get('HOST', '');\nif ($host !== '' && !preg_match('/^[a-zA-Z0-9.\\-]+(\\[[0-9a-fA-F:]+\\])?$/', $host)) {\n    return new Response('Bad Request', 400);\n}","typeGuard":null,"tryCatchPattern":"use Symfony\\Component\\HttpFoundation\\Exception\\SuspiciousOperationException;\n\ntry {\n    $host = $request->getHost();\n} catch (SuspiciousOperationException $e) {\n    return new Response('Invalid Host header', 400);\n}","preventionTips":["Configure Request::setTrustedHosts() / framework.trusted_hosts in every environment.","Enforce Host validation at the web server / reverse proxy layer.","Never echo or log the raw Host header unvalidated (injection risk).","Generate absolute URLs from configured base URL, not client Host."],"tags":["http","security","host-header","symfony"],"backgroundTag":"invalid-argument-value","analyzedSha":"5aea19cd678fa4140f6108406f1096de5e9ed6e4","analyzedAt":"2026-09-13T01:52:22.855Z","contentChangedAt":"2026-09-13T01:52:22.855Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}