What causes "Untrusted Host "%s"." in symfony/http-foundation?

Add the host to the trusted list: Request::setTrustedHosts(['^app\.example\.com$', '^(.+\.)?example\.com$']).

symfony/http-foundation · error · SuspiciousOperationException

Untrusted Host " ".

Error message

Untrusted Host "%s".

What it means

After passing the basic format check, getHost() verifies the host against the trusted host patterns configured via Request::setTrustedHosts(). A syntactically valid host that does not match any pattern throws SuspiciousOperationException('Untrusted Host "%s".') to prevent host header injection attacks.

Solutions

Add the host to the trusted list: Request::setTrustedHosts(['^app\.example\.com$', '^(.+\.)?example\.com$']).
In Symfony config, add it under framework.trusted_hosts.
Fix the request to use the canonical host (vhost/server_name configuration).
Catch SuspiciousOperationException around getHost()/absolute URL generation and return 400.

Example fix

// before
Request::setTrustedHosts(['^app\.example\.com$']);

// after (also allow staging)
Request::setTrustedHosts(['^app\.example\.com$', '^(staging|www)\.example\.com$']);

Defensive patterns

Strategy: try-catch

Validate before calling

$host = $request->headers->get('HOST', '');
$trusted = ['app.example.com', 'staging.example.com'];
if ($host !== '' && !in_array(strtolower($host), $trusted, true)) {
    return new Response('Untrusted Host', 400);
}

Try / catch

use Symfony\Component\HttpFoundation\Exception\SuspiciousOperationException;

try {
    $host = $request->getHost();
} catch (SuspiciousOperationException $e) {
    return new Response('Untrusted Host header', 400);
}

Prevention

Keep framework.trusted_hosts in sync with all domains/environments served.
Include internal health-check hostnames (LB IP, localhost) in trusted patterns if they call the app.
Update trusted hosts when adding CDN or preview domains.
Use anchored regex patterns (^...$) in setTrustedHosts to avoid partial matches.

When it happens

Trigger: Request arrives with Host 'evil.com' while setTrustedHosts(['^app\.example\.com$']) is configured; accessing the app via an IP, a load-balancer internal hostname, or a staging domain not included in the trusted list.

Common situations: New staging/preview environments or custom domains not added to framework.trusted_hosts; health checks or cron jobs hitting the app via 127.0.0.1 or internal LB DNS names; switching CDN domains without updating trusted hosts.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of symfony/http-foundation@5aea19cd67 (2026-09-13). Data as JSON: /api/errors/4f8927058607a3f9. Report an issue: GitHub.

Appendix: source

Thrown at Request.php:1241

                trigger_deprecation('symfony/http-foundation', '8.2', 'Populating the "%s::$trustedHosts" property is deprecated; it has no effect anymore.', self::class);
            }

            if (isset(self::$trustedHostsLiterals[$host])) {
                return $host;
            }

            foreach (self::$trustedHostsRegexps as $regexp) {
                if (preg_match($regexp, $host)) {
                    return $host;
                }
            }

            if (!$this->isHostValid) {
                return '';
            }
            $this->isHostValid = false;

            throw new SuspiciousOperationException(\sprintf('Untrusted Host "%s".', $host));
        }

        return $host;
    }

    /**
     * Sets the request method.
     */
    public function setMethod(string $method): void
    {
        $this->method = null;
        $this->server->set('REQUEST_METHOD', $method);
    }

    /**
     * Gets the request "intended" method.
     *
     * If the X-HTTP-Method-Override header is set, and if the method is a POST,

View on GitHub (pinned to 5aea19cd67)