{"record":{"id":"4f8927058607a3f9","repo":"symfony/http-foundation","slug":"untrusted-host-s","errorCode":null,"errorMessage":"Untrusted Host \"%s\".","messagePattern":"Untrusted Host \"(.+?)\"\\.","errorType":"exception","errorClass":"SuspiciousOperationException","httpStatus":400,"severity":"error","filePath":"Request.php","lineNumber":1241,"sourceCode":"                trigger_deprecation('symfony/http-foundation', '8.2', 'Populating the \"%s::$trustedHosts\" property is deprecated; it has no effect anymore.', self::class);\n            }\n\n            if (isset(self::$trustedHostsLiterals[$host])) {\n                return $host;\n            }\n\n            foreach (self::$trustedHostsRegexps as $regexp) {\n                if (preg_match($regexp, $host)) {\n                    return $host;\n                }\n            }\n\n            if (!$this->isHostValid) {\n                return '';\n            }\n            $this->isHostValid = false;\n\n            throw new SuspiciousOperationException(\\sprintf('Untrusted Host \"%s\".', $host));\n        }\n\n        return $host;\n    }\n\n    /**\n     * Sets the request method.\n     */\n    public function setMethod(string $method): void\n    {\n        $this->method = null;\n        $this->server->set('REQUEST_METHOD', $method);\n    }\n\n    /**\n     * Gets the request \"intended\" method.\n     *\n     * If the X-HTTP-Method-Override header is set, and if the method is a POST,","sourceCodeStart":1223,"sourceCodeEnd":1259,"githubUrl":"https://github.com/symfony/http-foundation/blob/5aea19cd678fa4140f6108406f1096de5e9ed6e4/Request.php#L1223-L1259","documentation":"After passing the basic format check, getHost() verifies the host against the trusted host patterns configured via Request::setTrustedHosts(). A syntactically valid host that does not match any pattern throws SuspiciousOperationException('Untrusted Host \"%s\".') to prevent host header injection attacks.","triggerScenarios":"Request arrives with Host 'evil.com' while setTrustedHosts(['^app\\.example\\.com$']) is configured; accessing the app via an IP, a load-balancer internal hostname, or a staging domain not included in the trusted list.","commonSituations":"New staging/preview environments or custom domains not added to framework.trusted_hosts; health checks or cron jobs hitting the app via 127.0.0.1 or internal LB DNS names; switching CDN domains without updating trusted hosts.","solutions":["Add the host to the trusted list: Request::setTrustedHosts(['^app\\.example\\.com$', '^(.+\\.)?example\\.com$']).","In Symfony config, add it under framework.trusted_hosts.","Fix the request to use the canonical host (vhost/server_name configuration).","Catch SuspiciousOperationException around getHost()/absolute URL generation and return 400."],"exampleFix":"// before\nRequest::setTrustedHosts(['^app\\.example\\.com$']);\n\n// after (also allow staging)\nRequest::setTrustedHosts(['^app\\.example\\.com$', '^(staging|www)\\.example\\.com$']);","handlingStrategy":"try-catch","validationCode":"$host = $request->headers->get('HOST', '');\n$trusted = ['app.example.com', 'staging.example.com'];\nif ($host !== '' && !in_array(strtolower($host), $trusted, true)) {\n    return new Response('Untrusted Host', 400);\n}","typeGuard":null,"tryCatchPattern":"use Symfony\\Component\\HttpFoundation\\Exception\\SuspiciousOperationException;\n\ntry {\n    $host = $request->getHost();\n} catch (SuspiciousOperationException $e) {\n    return new Response('Untrusted Host header', 400);\n}","preventionTips":["Keep framework.trusted_hosts in sync with all domains/environments served.","Include internal health-check hostnames (LB IP, localhost) in trusted patterns if they call the app.","Update trusted hosts when adding CDN or preview domains.","Use anchored regex patterns (^...$) in setTrustedHosts to avoid partial matches."],"tags":["http","security","trusted-hosts","symfony"],"backgroundTag":"invalid-config-value","analyzedSha":"5aea19cd678fa4140f6108406f1096de5e9ed6e4","analyzedAt":"2026-09-13T01:52:22.855Z","contentChangedAt":"2026-09-13T01:52:22.855Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}