{"record":{"id":"1b3d2ae65c5faa75","repo":"angular/angular-cli","slug":"warning-running-a-server-with-disable-host-chec","errorCode":null,"errorMessage":"Warning: Running a server with --disable-host-check is a security risk. See https://medium.com/webpack/webpack-dev-server-middleware-security-issues-1489d950874a for more information.","messagePattern":"Warning: Running a server with --disable-host-check is a security risk\\. See https://medium\\.com/webpack/webpack-dev-server-middleware-security-issues-1489d950874a for more information\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"packages/angular_devkit/build_angular/src/builders/dev-server/builder.ts","lineNumber":188,"sourceCode":"\n  if (\n    !normalizedOptions.disableHostCheck &&\n    !/^127\\.\\d+\\.\\d+\\.\\d+/g.test(normalizedOptions.host) &&\n    normalizedOptions.host !== 'localhost'\n  ) {\n    context.logger.warn(`\nWarning: This is a simple server for use in testing or debugging Angular applications\nlocally. It hasn't been reviewed for security issues.\n\nBinding this server to an open connection can result in compromising your application or\ncomputer. Using a different host than the one passed to the \"--host\" flag might result in\nwebsocket connection issues. You might need to use \"--disable-host-check\" if that's the\ncase.\n    `);\n  }\n\n  if (normalizedOptions.disableHostCheck) {\n    context.logger.warn(\n      'Warning: Running a server with --disable-host-check is a security risk. ' +\n        'See https://medium.com/webpack/webpack-dev-server-middleware-security-issues-1489d950874a for more information.',\n    );\n  }\n\n  normalizedOptions.port = await checkPort(normalizedOptions.port, normalizedOptions.host);\n\n  return {\n    builderName,\n    normalizedOptions,\n  };\n}\n\ninterface BuilderSelectorInfo {\n  builderName: string;\n  forceEsbuild: boolean;\n}\n","sourceCodeStart":170,"sourceCodeEnd":206,"githubUrl":"https://github.com/angular/angular-cli/blob/bb72145f9ab45aee29f523236b3a25cd0813a841/packages/angular_devkit/build_angular/src/builders/dev-server/builder.ts#L170-L206","documentation":"This is a warning emitted by the Angular dev-server builder when the `disableHostCheck` option is true. Disabling the host check makes webpack-dev-server accept connections with any Host header, which allows DNS-rebinding attacks where a malicious website can reach your dev server and execute code in the context of your machine. The CLI warns because you have explicitly opted out of a security protection.","triggerScenarios":"Running `ng serve --disable-host-check` or setting `\"disableHostCheck\": true` in the dev-server target options of angular.json; emitted from `initialize()` during server startup, before the port check.","commonSituations":"Developers testing inside Docker containers or VMs, accessing the dev server via a forwarded hostname or IP not in `allowedHosts`, or using preview/proxy URLs (e.g. ngrok, code-server) and reaching for the quickest fix to 'Invalid Host header'.","solutions":["Remove `--disable-host-check` and instead add your specific host with the `--allowed-hosts` option (webpack-dev-server 5+) or `allowedHosts` in the dev-server options","Access the dev server via localhost/127.0.0.1 so the default host check passes","If you must disable it, only do so on a trusted network and never expose the dev server publicly","Suppress awareness: accept the warning only in ephemeral/sandboxed environments"],"exampleFix":"// before\nng serve --disable-host-check\n// after\nng serve --allowed-hosts myapp.dev.example.com","handlingStrategy":"validation","validationCode":"// angular.json serve options pre-check\nconst dangerous = options.disableHostCheck === true;\nif (dangerous) {\n  console.warn('Host check disabled: ensure the dev server is not exposed to untrusted networks; prefer --allowed-hosts <host>.');\n}","typeGuard":"function isHostCheckDisabled(o: { disableHostCheck?: boolean }): boolean {\n  return o?.disableHostCheck === true;\n}","tryCatchPattern":null,"preventionTips":["Prefer --allowed-hosts with explicit hostnames over --disable-host-check","Never expose dev-server ports (4200) beyond localhost in shared/office networks","Audit CI/docker scripts for leftover --disable-host-check flags","Document the security implication in team runbooks so the flag is not copied blindly"],"tags":["webpack-dev-server","security","host-check","dns-rebinding"],"backgroundTag":"disable-host-check-security-warning","analyzedSha":"bb72145f9ab45aee29f523236b3a25cd0813a841","analyzedAt":"2026-08-30T02:47:34.745Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}