phalcon/cphalcon · error · Phalcon\Http\Request\Exceptions\InvalidHost

Invalid host {host}

Error message

Invalid host {host}

What it means

Request::getHttpHost() with strict host checking enabled (setStrictHostCheck(true)) validates the resolved host (HTTP_HOST, then SERVER_NAME, then SERVER_ADDR) against RFC 952/2181: after lowercasing, trimming and stripping a trailing ':port', it may contain only a-z, 0-9, hyphen and dots. Any other character (underscore, IPv6 brackets, unicode) throws InvalidHost.

Source

Thrown at phalcon/Http/Request.zep:624

        if host && strict {
            /**
             * Cleanup. Force lowercase as per RFC 952/2181
             */
            let cleanHost = strtolower(
                trim(host)
            );

            if memstr(cleanHost, ":") {
                let cleanHost = preg_replace("/:[[:digit:]]+$/", "", cleanHost);
            }

            /**
             * Host may contain only the ASCII letters 'a' through 'z'
             * (in a case-insensitive manner), the digits '0' through '9', and
             * the hyphen ('-') as per RFC 952/2181
             */
            if unlikely ("" !== preg_replace("/[a-z0-9-]+\.?/", "", cleanHost)) {
                throw new InvalidHost(host);
            }
        } else {
            let cleanHost = host;
        }

        return (string) cleanHost;
    }

    /**
     * Return the HTTP method parameter override flag
     *
     * @return bool
     */
    public function getHttpMethodParameterOverride() -> bool
    {
        return this->methodOverride;
    }

View on GitHub (pinned to b7419de9cd)

Solutions

1. Fix the Host header at origin: rename underscore hostnames, configure web server server_name / proxy_set_header Host with RFC-valid names
2. Normalize or whitelist the host in the front controller before strict consumers read it
3. Disable strict mode when legitimate non-RFC hosts must pass: $request->setStrictHostCheck(false)
4. Catch Phalcon\Http\Request\Exceptions\InvalidHost and answer 400 Bad Request

Example fix

// before
$request->setStrictHostCheck(true);
$host = $request->getHttpHost(); // throws on 'my_service.local'

// after
$raw = strtolower(trim((string) $request->getServer('HTTP_HOST')));
$host = preg_replace('/:[0-9]+$/', '', $raw);
if (!preg_match('/^[a-z0-9.-]+\.?$/', $host)) {
    $host = 'www.example.com'; // fallback to canonical host
}

$raw = strtolower(trim((string) $request->getServer('HTTP_HOST')));
$host = preg_replace('/:[0-9]+$/', '', $raw);
if (!preg_match('/^[a-z0-9.-]+\.?$/', $host)) {
    $host = 'www.example.com'; // or reject with 400
}
// safe to call $request->getHttpHost() with strict checks, or use $host directly

try { $host = $request->getHttpHost(); } catch (\Phalcon\Http\Request\Exceptions\InvalidHost $e) { http_response_code(400); exit('Invalid Host header'); }

When it happens

Trigger: $request->setStrictHostCheck(true) followed by $request->getHttpHost() when the Host header is 'my_service.local' (underscore), '[::1]:8080' (IPv6 literal), or an internationalized domain name.

Common situations: Kubernetes/Docker service names containing underscores; IPv6 literals forwarded by proxies; scanners sending malformed Host headers; hardened apps that enable strict checks behind a load balancer passing unusual Host values.

Related errors

• Invalid HTTP method: {methods}
• Unable to insert into {table} without data
• The number of values in the update is not the same as fields
• Invalid HTTP method: non-string
• Response was already sent

AI-assisted analysis of phalcon/cphalcon@b7419de9cd (2026-08-21). Data as JSON: /api/errors/18c309e017f234c3. Report an issue: GitHub.