{"record":{"id":"d07e2a135861d9c2","repo":"angular/angular-cli","slug":"warning-this-is-a-simple-server-for-use-in-testi","errorCode":null,"errorMessage":"\nWarning: This is a simple server for use in testing or debugging Angular applications\nlocally. It hasn't been reviewed for security issues.\n\nBinding this server to an open connection can result in compromising your application or\ncomputer. Using a different host than the one passed to the \"--host\" flag might result in\nwebsocket connection issues. You might need to use \"--disable-host-check\" if that's the\ncase.\n    ","messagePattern":"\nWarning: This is a simple server for use in testing or debugging Angular applications\nlocally\\. It hasn't been reviewed for security issues\\.\n\nBinding this server to an open connection can result in compromising your application or\ncomputer\\. Using a different host than the one passed to the \"--host\" flag might result in\nwebsocket connection issues\\. You might need to use \"--disable-host-check\" if that's the\ncase\\.\n    ","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"packages/angular_devkit/build_angular/src/builders/dev-server/builder.ts","lineNumber":176,"sourceCode":") {\n  // Purge old build disk cache.\n  await purgeStaleBuildCache(context);\n\n  const normalizedOptions = await normalizeOptions(context, projectName, initialOptions);\n  const builderName = builderSelector(\n    {\n      builderName: await context.getBuilderNameForTarget(normalizedOptions.buildTarget),\n      forceEsbuild: !!normalizedOptions.forceEsbuild,\n    },\n    context.logger,\n  );\n\n  if (\n    !normalizedOptions.disableHostCheck &&\n    !/^127\\.\\d+\\.\\d+\\.\\d+/g.test(normalizedOptions.host) &&\n    normalizedOptions.host !== 'localhost'\n  ) {\n    context.logger.warn(`\nWarning: This is a simple server for use in testing or debugging Angular applications\nlocally. It hasn't been reviewed for security issues.\n\nBinding this server to an open connection can result in compromising your application or\ncomputer. Using a different host than the one passed to the \"--host\" flag might result in\nwebsocket connection issues. You might need to use \"--disable-host-check\" if that's the\ncase.\n    `);\n  }\n\n  if (normalizedOptions.disableHostCheck) {\n    context.logger.warn(\n      'Warning: Running a server with --disable-host-check is a security risk. ' +\n        'See https://medium.com/webpack/webpack-dev-server-middleware-security-issues-1489d950874a for more information.',\n    );\n  }\n\n  normalizedOptions.port = await checkPort(normalizedOptions.port, normalizedOptions.host);","sourceCodeStart":158,"sourceCodeEnd":194,"githubUrl":"https://github.com/angular/angular-cli/blob/bb72145f9ab45aee29f523236b3a25cd0813a841/packages/angular_devkit/build_angular/src/builders/dev-server/builder.ts#L158-L194","documentation":"Security warning printed by dev-server initialization when the server binds to a non-loopback host without --disable-host-check. The dev server is a local development tool not hardened for public exposure; binding it to an open interface risks exposing your machine, and mismatched hosts can break WebSocket HMR connections.","triggerScenarios":"`normalizedOptions.host` matches neither /^127\\.d+.d+.d+/ nor 'localhost' while disableHostCheck is falsy — e.g. host set to 0.0.0.0, a LAN IP, or a custom hostname.","commonSituations":"Testing on physical devices via LAN IP; Docker containers binding to 0.0.0.0; enterprise proxies requiring a public host, where HMR websockets then fail.","solutions":["If serving externally is required, explicitly add `--disable-host-check` after understanding the risk.","Otherwise bind to localhost/127.0.0.1 to silence the warning and stay safe.","For device testing, prefer `ng serve --host 0.0.0.0 --disable-host-check` on trusted networks only.","For proxy setups, configure the allowed hosts properly instead of ignoring host checks blindly."],"exampleFix":"// before\nng serve --host 0.0.0.0\n// after\nng serve --host 0.0.0.0 --disable-host-check  // trusted network only\n// or\nng serve --host localhost","handlingStrategy":"validation","validationCode":"const host = options.host ?? 'localhost';\nconst isLoopback = host === 'localhost' || /^127\\.\\d+\\.\\d+\\.\\d+$/.test(host);\nif (!isLoopback && !options.disableHostCheck) {\n  console.warn('Binding to a non-loopback host without --disable-host-check; add disableHostCheck or use localhost.');\n}","typeGuard":"function isSafeHost(o: { host?: string; disableHostCheck?: boolean }): boolean {\n  const h = o.host ?? 'localhost';\n  return o.disableHostCheck === true || h === 'localhost' || /^127\\.\\d+\\.\\d+\\.\\d+$/.test(h);\n}","tryCatchPattern":null,"preventionTips":["Bind dev servers to localhost unless external access is explicitly needed.","Never run dev servers exposed to the internet; use previews/staging for sharing.","Combine 0.0.0.0 binding with --disable-host-check only on trusted networks."],"tags":["dev-server","security","host-binding","angular-cli"],"backgroundTag":"dev-server-host-binding-warning","analyzedSha":"bb72145f9ab45aee29f523236b3a25cd0813a841","analyzedAt":"2026-08-30T02:47:34.745Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}