{"record":{"id":"7c0a44cd4717d63f","repo":"symfony/routing","slug":"route-host-s-cannot-contain-s-as-a-host-parameter","errorCode":null,"errorMessage":"Route host \"%s\" cannot contain \"%s\" as a host parameter.","messagePattern":"Route host \"(.+?)\" cannot contain \"(.+?)\" as a host parameter\\.","errorType":"exception","errorClass":"InvalidArgumentException","httpStatus":null,"severity":"error","filePath":"RouteCompiler.php","lineNumber":59,"sourceCode":"     *                                   a PCRE subpattern\n     */\n    public static function compile(Route $route): CompiledRoute\n    {\n        $hostVariables = [];\n        $variables = [];\n        $hostRegex = null;\n        $hostTokens = [];\n\n        if ('' !== $host = $route->getHost()) {\n            $result = self::compilePattern($route, $host, true);\n\n            $hostVariables = $result['variables'];\n            $variables = $hostVariables;\n\n            foreach ($hostVariables as $hostParam) {\n                // \"_firewall\" selects the firewall handling the route; as a host parameter it would let the Host header choose it\n                if ('_firewall' === $hostParam) {\n                    throw new \\InvalidArgumentException(\\sprintf('Route host \"%s\" cannot contain \"%s\" as a host parameter.', $host, $hostParam));\n                }\n            }\n\n            $hostTokens = $result['tokens'];\n            $hostRegex = $result['regex'];\n        }\n\n        $locale = $route->getDefault('_locale');\n        if (null !== $locale && null !== $route->getDefault('_canonical_route') && preg_quote($locale) === $route->getRequirement('_locale')) {\n            $requirements = $route->getRequirements();\n            unset($requirements['_locale']);\n            $route->setRequirements($requirements);\n            $route->setPath(str_replace('{_locale}', $locale, $route->getPath()));\n        }\n\n        $path = $route->getPath();\n\n        $result = self::compilePattern($route, $path, false);","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/symfony/routing/blob/83fa223250b50f4f018c011e101c330e65ac63cc/RouteCompiler.php#L41-L77","documentation":"Symfony's RouteCompiler rejects a route whose host section uses the reserved parameter name \"_firewall\" as a host variable. The \"_firewall\" key selects which firewall handles the route internally; if it were allowed as a host parameter, an attacker could pick the firewall simply by sending a chosen Host header. The compiler therefore throws an InvalidArgumentException during compile() to prevent this security hole.","triggerScenarios":"Calling RouteCompiler::compile() (directly or via RouteCollection compilation) on a route whose host, e.g. ->setHost('{_firewall}.example.com') or any host containing {_firewall}, is compiled.","commonSituations":"Copy-pasting a path parameter name into the host part of a route; misreading reserved names and thinking _firewall is a normal route argument; generating route hosts dynamically from user/controller parameter names.","solutions":["Rename the host variable in the route host to something other than \"_firewall\", e.g. {subdomain}.example.com.","If you intended to select a firewall, use the proper mechanism instead (firewall context / matcher configuration), not a route host parameter.","Audit route definitions (YAML/PHP/attributes) for {_firewall} in the host key or setHost() calls."],"exampleFix":"// before\n$route->setHost('{_firewall}.example.com');\n\n// after\n$route->setHost('{subdomain}.example.com');","handlingStrategy":"validation","validationCode":"// before compiling / registering the route\nif (str_contains($route->getHost(), '{_firewall}')) {\n    throw new \\InvalidArgumentException('Route host must not use the reserved {_firewall} parameter.');\n}","typeGuard":null,"tryCatchPattern":"// optional safety net when compiling dynamic routes\ntry {\n    (new RouteCompiler())->compile($route);\n} catch (\\InvalidArgumentException $e) {\n    $this->logger->error('Invalid route host parameter', ['exception' => $e]);\n}","preventionTips":["Never name route placeholders with a leading underscore unless they are documented reserved names (_controller, _locale, _format, _fragment).","Add a static analysis or test pass over RouteCollection definitions checking reserved names.","Keep firewall selection in security.yaml, not in route hosts."],"tags":["routing","symfony","invalid-argument","reserved-parameter"],"backgroundTag":"invalid-argument-value","analyzedSha":"83fa223250b50f4f018c011e101c330e65ac63cc","analyzedAt":"2026-09-14T03:19:46.280Z","contentChangedAt":"2026-09-14T03:19:46.280Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}