{"record":{"id":"697716f17d4eb617","repo":"angular/angular-cli","slug":"trust-all-proxy-headers-is-not-allowed-as-a-v","errorCode":null,"errorMessage":"\"${TRUST_ALL_PROXY_HEADERS}\" is not allowed as a value for the \"trustProxyHeaders\" option.","messagePattern":"\"(.+?)\" is not allowed as a value for the \"trustProxyHeaders\" option\\.","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/angular/ssr/src/utils/validation.ts","lineNumber":269,"sourceCode":" * @param trustProxyHeaders The input `trustProxyHeaders` value.\n * @returns A `Set<string>` of normalized header names.\n */\nexport function normalizeTrustProxyHeaders(\n  trustProxyHeaders: boolean | readonly string[] | undefined,\n): ReadonlySet<string> {\n  if (!trustProxyHeaders) {\n    return new Set();\n  }\n\n  if (trustProxyHeaders === true) {\n    return new Set([TRUST_ALL_PROXY_HEADERS]);\n  }\n\n  const normalizedTrustedProxyHeaders = new Set<string>();\n  for (const header of trustProxyHeaders) {\n    const lowerHeader = header.toLowerCase();\n    if (lowerHeader === TRUST_ALL_PROXY_HEADERS) {\n      throw new Error(\n        `\"${TRUST_ALL_PROXY_HEADERS}\" is not allowed as a value for the \"trustProxyHeaders\" option.`,\n      );\n    }\n    const isValid = lowerHeader === 'forwarded' || lowerHeader.startsWith('x-forwarded-');\n    if (!isValid) {\n      throw new Error(\n        `\"${header}\" is not a valid proxy header. Trusted proxy headers must be \"forwarded\" or start with \"x-forwarded-\".`,\n      );\n    }\n    normalizedTrustedProxyHeaders.add(lowerHeader);\n  }\n\n  return normalizedTrustedProxyHeaders;\n}\n\n/**\n * Parses the standard `Forwarded` header (RFC 7239).\n * It extracts the parameters from the first (leftmost) element in the header.","sourceCodeStart":251,"sourceCodeEnd":287,"githubUrl":"https://github.com/angular/angular-cli/blob/bb72145f9ab45aee29f523236b3a25cd0813a841/packages/angular/ssr/src/utils/validation.ts#L251-L287","documentation":"The `trustProxyHeaders` option accepts individual proxy header names, or the wildcard `*` meaning trust all. Angular SSR forbids passing `*` as an element within the list of header names in `normalizeTrustProxyHeaders` — the sentinel is only valid as the sole value meaning 'trust everything', so mixing it with named headers is rejected at construction/validation time.","triggerScenarios":"Calling the SSR server API with `trustProxyHeaders: ['*', 'x-forwarded-proto']` or similar, where `*` appears alongside other header names.","commonSituations":"Copy-pasting config snippets; misunderstanding that `*` is a standalone value; migration from older configs that allowed any header names.","solutions":["Use `trustProxyHeaders: '*'` alone if you truly want to trust all proxy headers (not recommended).","Otherwise remove the `'*'` entry and list only the specific headers you trust, e.g. `['x-forwarded-host', 'x-forwarded-proto']`.","Only list headers your reverse proxy actually sets and controls."],"exampleFix":"// before\nnew AngularServerApp({ trustProxyHeaders: ['*', 'x-forwarded-proto'] });\n// after\nnew AngularServerApp({ trustProxyHeaders: ['x-forwarded-proto', 'x-forwarded-host'] });","handlingStrategy":"validation","validationCode":"const headers = ['*', 'x-forwarded-proto'];\nif (headers.includes('*') && headers.length > 1) throw new Error('Use \"*\" alone or list specific proxy headers');","typeGuard":"function isTrustProxyHeadersValid(v: string[] | '*'): boolean {\n  return v === '*' || (Array.isArray(v) && !v.includes('*'));\n}","tryCatchPattern":"try {\n  const app = new AngularServerApp({ trustProxyHeaders: cfg.trustProxyHeaders });\n} catch (e) {\n  if ((e as Error).message.includes('trustProxyHeaders')) {\n    throw new Error('Fix trustProxyHeaders config: \"*\" must be used alone.');\n  }\n  throw e;\n}","preventionTips":["Prefer explicit header lists over the wildcard sentinel.","Validate the trustProxyHeaders config at app startup, not on first request.","Document that \"*\" is a standalone value in team config conventions."],"tags":["angular","ssr","configuration","security","validation"],"backgroundTag":"invalid-configuration-value","analyzedSha":"bb72145f9ab45aee29f523236b3a25cd0813a841","analyzedAt":"2026-08-30T02:47:34.745Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}