0

I got the trusted host settings error.

The trusted_host_patterns setting is not configured in settings.php. This can lead to security vulnerabilities. It is highly recommended that you configure this. See Protecting against HTTP HOST Header attacks for more information.

I read the Trusted Host Settings documentation but I'm not understanding some of the basic context.

  • Are the "trusted hosts" me and other administrators who want to be able to administer the site remotely?
  • If so, would I add my PC's domain to the trusted host list?
Improve this question
4
  • Is this an error? Or is this a warning?
    – leymannx
    May 22, 2020 at 19:54
  • @leymannx I believe it said error, oddly. Should have included a screenshot before I corrected it.
    – glenviewjeff
    May 23, 2020 at 1:10
  • @leymannx yes, just restored a backup for a different reason and it does fall under the "Errors found" heading.
    – glenviewjeff
    May 26, 2020 at 18:27
  • @leymannx no, that question is for someone who can't see their site and gets an error with mal-configured trusted-host-patterns. My question is about what "trusted host" means. I specifically asked for "some of the basic context." And I didn't see a plain-English answer mentioning what trusted host means, only detailed explanation about the motivation for its implementation, echoing what I'd linked to in the documentation I'd already read.
    – glenviewjeff
    May 31, 2020 at 20:42

1 Answer 1

Reset to default
4

Trusted hosts refer to the domain that your Drupal site is hosting, not your remote PC's domain that is administering the site. For example, if your site running on Drupal was www.thedrupaldude.com, the trusted host regular expression would be ^www\.thedrupaldude\.com.

Improve this answer
3
  • Understanding trusted hosts also is about understanding the actual pattern you need to enter. Pay attention for the punctuation. See drupal.stackexchange.com/q/145286/15055
    – leymannx
    May 31, 2020 at 20:12
  • 1
    Yes, since it's a regular expression, you cannot simply put 'www.example.com', but it needs to be changed to '^www\.example\.com', for example.
    – apaderno ♦
    May 31, 2020 at 20:41
  • Thanks, corrected. Happened to work anyhow of course because of regular expressions.
    – glenviewjeff
    May 31, 2020 at 20:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.