# starlette.middleware.trustedhost: 无效的 Host 头：'evil.example.com'

- **ID:** `python/starlette-trustedhost-invalid-host-header`
- **领域:** python
- **类别:** config_error
- **验证级别:** ai_generated
- **修复率:** 80%

## 根因

TrustedHostMiddleware 拒绝 Host 头不在 allowed_hosts 中的请求，常见于代理未正确转发 Host。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| 3.x | active | — | — |

## 解决方案

1. **** (88% 成功率)
   ```
   Configure proxy to forward Host, and list real hosts:
app.add_middleware(TrustedHostMiddleware, allowed_hosts=['api.example.com'])
   ```
2. **** (82% 成功率)
   ```
   Use ProxyHeadersMiddleware/forwarded headers in the ASGI server config.
   ```

## 无效尝试

- **** — Disables the protection entirely, defeating the middleware purpose. (60% 失败率)
- **** — Reopens host header injection and loses the security control. (70% 失败率)