This question already has an answer here:

From Drupal 8 beta 6 (released today), I have this error :

Error message UnexpectedValueException: Untrusted Host "localhost" in Symfony\Component\HttpFoundation\Request->getHost() (line 1221 of core/vendor/symfony/http-foundation/Symfony/Component/HttpFoundation/Request.php).

I use this local url to call my site: http://theming.dev

Inside my setting file, I have:

     $settings['trusted_host_patterns'] = array(
        'theming\.dev$',
     );

Note, this error is displayed only when I uncomment this lines:

 if (file_exists(__DIR__ . '/settings.local.php')) {
   include __DIR__ . '/settings.local.php';
 }

What is the problem please ? Thanks.

marked as duplicate by kiamlaluno Nov 2 '16 at 15:34

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • Does settings.local.php exist? – Clive Jan 28 '15 at 14:06
  • Yes, I have here /sites/default/settings.local.php – Axel Briche Jan 28 '15 at 14:08
  • And you've update $settings['trusted_host_patterns'] in that file too? – Clive Jan 28 '15 at 14:08
  • $settings['trusted_host_patterns'] = array( '^localhost$', '^localhost\.*', '\.local$', ); is now $settings['trusted_host_patterns'] = array( '^theming$', '^theming\.*', '\.local$', ); – Axel Briche Jan 28 '15 at 14:11
  • 1
    Can you not specify the IP address of your server, or use a domain name? – iantresman Jan 28 '15 at 16:12

This problem occurred for me when building an 8.0.0-beta6 test site on my Ubuntu 14.04 laptop. I have an Apache web server running locally, with the test site defined using a VirtualHost directive. I add the domain name of the test site ("example.com") to my /etc/hosts file, pointing to 127.0.2.1, to bypass the need to use real DNS entries.

After installing the site, everything looked fine. However, I noticed a warning message on the Status Report page about not having trusted_host_patterns set, so I went into my /sites/default/settings.php file and added these lines:

$settings['trusted_host_patterns'] = array(
  '^example\.com$',
  '^www\.example\.com$',
);

Upon saving the file and reloading my browser, I got a very generic error page and, after commenting-out the new lines, noticed the Untrusted Host "localhost"... log message.

It appears that because I'm web-browsing from the same computer on which the web server is running, the Host is at some point getting converted to localhost, and thus is failing to match the set of patterns I had specified. I was able to fix this issue by changing these lines to:

$settings['trusted_host_patterns'] = array(
  '^example\.com$',
  '^www\.example\.com$',
  '^localhost$',
);

On a site that is intended to be put into production, you might want to utilize a settings.local.php file to specify ^localhost$ as a valid host pattern for testing purposes only. Note that if you want to do this, you'll need to uncomment these lines in the default settings.php, and move them to the bottom of the settings.php file:

if (file_exists(__DIR__ . '/settings.local.php')) {
  include __DIR__ . '/settings.local.php';
}

In this case, the settings.php file would only contain the actual domain names:

$settings['trusted_host_patterns'] = array(
  '^example\.com$',
  '^www\.example\.com$',
);

and settings.local.php would contain:

<?php
$settings['trusted_host_patterns'][] = '^localhost$';

to append localhost to the list of valid hosts. With this configuration, you would not copy the settings.local.php file when copying the site to the production server.

  • Did you gave this problem on all pages on your site, or just some? – mpdonadio Feb 1 '15 at 17:18
  • Like @hampercm I had to have ^localhost$ on the end of my array like: 'code' $settings['trusted_host_patterns'] = array( '^alpha8\.local$', '^localhost$',); 'code' – bumpaw Feb 3 '15 at 2:19
  • @MPD: Yes, I had error messages for all pages on my site before the fix I posted above, though it also seemed to depend on the web browser: Chrome on Ubuntu would only display the error when in Incognito mode. Chrome on Android displayed the error always. Firefox on Ubuntu doesn't display the error. – hampercm Feb 3 '15 at 16:13
  • Scratch "Chrome on Android" off the list of browsers I gave in my previous comment. That was a different issue that I ran into on the same day :) – hampercm Feb 3 '15 at 16:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.