What causes "The trusted header "%s" is not supported." in symfony/http-kernel?

Fix the trusted_headers value to valid names: 'x-forwarded-for', 'x-forwarded-port', 'x-forwarded-proto', 'x-forwarded-host', 'x-forwarded-prefix', 'x-forwarded-azure-appservice', or 'x-forwarded-all'

symfony/http-kernel · error · InvalidArgumentException

The trusted header " " is not supported.

Error message

The trusted header "%s" is not supported.

What it means

When booting the kernel with trusted header configuration (framework.trusted_headers), each named header is mapped to a Request::HEADER_* constant. If a configured header name has no matching constant, Request::HEADER_<NAME> is undefined and this InvalidArgumentException is thrown during preBoot, before the app serves requests.

Solutions

Fix the trusted_headers value to valid names: 'x-forwarded-for', 'x-forwarded-port', 'x-forwarded-proto', 'x-forwarded-host', 'x-forwarded-prefix', 'x-forwarded-azure-appservice', or 'x-forwarded-all'
Use the constant name it maps to in Request (HEADER_X_FORWARDED_*) as reference
Remove unknown entries from the config

Example fix

// before (config)
trusted_headers: ['x-forwarded-for', 'x-forwarded-hostt']
// after
trusted_headers: ['x-forwarded-for', 'x-forwarded-host']

Defensive patterns

Strategy: validation

Validate before calling

$allowed = ['x-forwarded-for','x-forwarded-host','x-forwarded-port','x-forwarded-proto','x-forwarded-prefix','x-forwarded-azure-appservice'];
$invalid = array_diff($trustedHeaders, $allowed);
if ($invalid) {
    throw new \InvalidArgumentException('Unsupported trusted headers: '.implode(', ', $invalid));
}

Try / catch

try {
    $kernel->boot();
} catch (\InvalidArgumentException $e) {
    if (str_contains($e->getMessage(), 'trusted header')) {
        // correct the framework.trusted_headers config and retry boot
    }
}

Prevention

Only use documented x-forwarded-* names in framework.trusted_headers
Validate config with the framework's config linter (bin/console lint:yaml / config dump)
Re-check trusted_headers after Symfony upgrades

When it happens

Trigger: Setting framework.trusted_headers (or Request::setTrustedHeaders via kernel boot) to a name that is not a known X-Forwarded-* header constant, e.g. a typo like 'x-forwarded-hostt' or an empty/invalid string.

Common situations: Typos in symfony framework.yaml trusted_headers; upgrading Symfony and using a header name that no longer exists; copying config snippets with made-up header names.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of symfony/http-kernel@aa3a39d728 (2026-09-13). Data as JSON: /api/errors/85cc53f868b08155. Report an issue: GitHub.

Appendix: source

Thrown at Kernel.php:285

        $container = $this->container;

        if ($container->hasParameter('kernel.trusted_hosts') && $trustedHosts = $container->getParameter('kernel.trusted_hosts')) {
            Request::setTrustedHosts(\is_array($trustedHosts) ? $trustedHosts : preg_split('/\s*+,\s*+(?![^{]*})/', $trustedHosts));
        }

        if ($container->hasParameter('kernel.trusted_proxies') && $container->hasParameter('kernel.trusted_headers') && $trustedProxies = $container->getParameter('kernel.trusted_proxies')) {
            $trustedHeaders = $container->getParameter('kernel.trusted_headers');

            if (\is_string($trustedHeaders)) {
                $trustedHeaders = array_map('trim', explode(',', $trustedHeaders));
            }

            if (\is_array($trustedHeaders)) {
                $trustedHeaderSet = 0;

                foreach ($trustedHeaders as $header) {
                    if (!\defined($const = Request::class.'::HEADER_'.strtr(strtoupper($header), '-', '_'))) {
                        throw new \InvalidArgumentException(\sprintf('The trusted header "%s" is not supported.', $header));
                    }
                    $trustedHeaderSet |= \constant($const);
                }
            } else {
                $trustedHeaderSet = $trustedHeaders ?? (Request::HEADER_X_FORWARDED_FOR | Request::HEADER_X_FORWARDED_PORT | Request::HEADER_X_FORWARDED_PROTO);
            }

            Request::setTrustedProxies(\is_array($trustedProxies) ? $trustedProxies : array_map('trim', explode(',', $trustedProxies)), $trustedHeaderSet);
        }
    }

    private function getEffectiveBuildDir(): string
    {
        return $this->warmupDir ?: $this->getBuildDir();
    }
}

View on GitHub (pinned to aa3a39d728)