{"record":{"id":"4e2b22035b734631","repo":"sveltejs/kit","slug":"the-port-header-header-specified-port-which-4e2b22","errorCode":null,"errorMessage":"The ${port_header} header specified ${port} which is an invalid port because it is not a number. The value should only contain the port number (e.g. 443)","messagePattern":"The (.+?) header specified (.+?) which is an invalid port because it is not a number\\. The value should only contain the port number \\(e\\.g\\. 443\\)","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/adapter-node/src/handler.js","lineNumber":267,"sourceCode":"\tif (protocol.includes(':')) {\n\t\tthrow new Error(\n\t\t\t`The ${protocol_header} header specified ${protocol} which is an invalid because it includes \\`:\\`. It should only contain the protocol scheme (e.g. \\`https\\`)`\n\t\t);\n\t}\n\n\tconst host =\n\t\tnormalise_header(host_header, headers[host_header]) ||\n\t\tnormalise_header('host', headers['host']);\n\tif (!host) {\n\t\tconst header_names = host_header ? `${host_header} or host headers` : 'host header';\n\t\tthrow new Error(\n\t\t\t`Could not determine host. The request must have a value provided by the ${header_names}`\n\t\t);\n\t}\n\n\tconst port = normalise_header(port_header, headers[port_header]);\n\tif (port && isNaN(+port)) {\n\t\tthrow new Error(\n\t\t\t`The ${port_header} header specified ${port} which is an invalid port because it is not a number. The value should only contain the port number (e.g. 443)`\n\t\t);\n\t}\n\n\treturn port ? `${protocol}://${host}:${port}` : `${protocol}://${host}`;\n}\n\nexport const handler = sequence(\n\t/** @type {(RequestHandler | Middleware)[]} */\n\t([serve(path.join(dir, 'client'), true), serve_prerendered(), ssr].filter(Boolean))\n);\n","sourceCodeStart":249,"sourceCodeEnd":279,"githubUrl":"https://github.com/sveltejs/kit/blob/03f1687fe612ce3d2d9131139b5b188d9cf90c64/packages/adapter-node/src/handler.js#L249-L279","documentation":"If a PORT_HEADER (e.g. x-forwarded-port) is supplied, its value must be numeric so it can be appended to the origin as :port. A non-numeric value is rejected to prevent malformed origins and origin injection.","triggerScenarios":"A request arrives with the configured PORT_HEADER containing a non-numeric value (e.g. 'https', '443,80', or URL-encoded junk) and get_origin calls isNaN(+port).","commonSituations":"Proxies appending multiple port values, or clients injecting arbitrary header content when the port header is publicly settable.","solutions":["Fix the proxy so it sends a single numeric port, e.g. x-forwarded-port: 443","Change PORT_HEADER to a header only your trusted proxy sets","Strip/deduplicate the header value at the proxy layer"],"exampleFix":"// before\nx-forwarded-port: https\n// after\nx-forwarded-port: 443","handlingStrategy":"validation","validationCode":"const port = req.headers['x-forwarded-port'];\nif (typeof port === 'string' && isNaN(Number(port))) {\n  throw new Error('x-forwarded-port must be numeric');\n}","typeGuard":"function isNumericPort(v) {\n  return typeof v === 'string' && /^\\d+$/.test(v);\n}","tryCatchPattern":"try {\n  origin = getOrigin(headers);\n} catch (err) {\n  if (String(err.message).includes('is not a number')) {\n    console.error('Port header must be a single numeric value, e.g. 443');\n  } else {\n    throw err;\n  }\n}","preventionTips":["Proxy should send a single numeric port in x-forwarded-port","Restrict PORT_HEADER to headers only trusted infrastructure sets","Monitor 500s referencing the port header to catch proxy regressions"],"tags":["http","headers","security","proxy"],"backgroundTag":"invalid-port-header","analyzedSha":"03f1687fe612ce3d2d9131139b5b188d9cf90c64","analyzedAt":"2026-09-02T02:01:50.504Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}