# starlette.middleware.trustedhost: Invalid host header: 'evil.example.com'

- **ID:** `python/starlette-trustedhost-invalid-host-header`
- **Domain:** python
- **Category:** config_error
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

TrustedHostMiddleware rejects requests whose Host header isn't in allowed_hosts, common behind proxies with wrong host forwarding.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| 3.x | active | — | — |

## Workarounds

1. **** (88% success)
   ```
   Configure proxy to forward Host, and list real hosts:
app.add_middleware(TrustedHostMiddleware, allowed_hosts=['api.example.com'])
   ```
2. **** (82% success)
   ```
   Use ProxyHeadersMiddleware/forwarded headers in the ASGI server config.
   ```

## Dead Ends

- **** — Disables the protection entirely, defeating the middleware purpose. (60% fail)
- **** — Reopens host header injection and loses the security control. (70% fail)