allowedHosts doesn't allow for my-site_1.localhost type host. #32835
Description
Which @angular/* package(s) are the source of the bug?
Don't known / other
Is this a regression?
Yes
Description
I use traefik as a reverse proxy to serve an angular app at http://my-site_1.localhost on a dev environment.
After upgrading to version 21 from version 20, neither of the following strings in NG_ALLOWED_HOSTS (also tried project.browser.architect.build.options.security.allowedHosts with the same issue) allow for the use of a my-site_1.localhost type url for the host.
NG_ALLOWED_HOSTS='*,localhost,*.localhost,my-site_1.localhost' ng serve --host 0.0.0.0"
Accessing http://localhost:PORT is working. Accessing http://my-site_1.localhost throw a 400 Bad request (Header "host" contains characters that are not allowed.).
Please provide a link to a minimal reproduction of the bug
No response
Please provide the exception or error you saw
Header "host" contains characters that are not allowed.
Please provide the environment you discovered this bug in (run ng version)
Angular CLI : 21.2.3
Angular : 21.2.5
Node.js : 20.20.1
Package Manager : npm 10.8.2
Operating System : linux arm64
┌───────────────────────────────────┬───────────────────┬───────────────────┐
│ Package │ Installed Version │ Requested Version │
├───────────────────────────────────┼───────────────────┼───────────────────┤
│ @angular-devkit/build-angular │ 21.2.3 │ ^21.2.3 │
│ @angular/animations │ 21.2.5 │ ^21.2.5 │
│ @angular/cdk │ 21.2.4 │ ^21.2.4 │
│ @angular/cli │ 21.2.3 │ ^21.2.3 │
│ @angular/common │ 21.2.5 │ ^21.2.5 │
│ @angular/compiler │ 21.2.5 │ ^21.2.5 │
│ @angular/compiler-cli │ 21.2.5 │ ^21.2.5 │
│ @angular/core │ 21.2.5 │ ^21.2.5 │
│ @angular/forms │ 21.2.5 │ ^21.2.5 │
│ @angular/language-service │ 21.2.5 │ ^21.2.5 │
│ @angular/platform-browser │ 21.2.5 │ ^21.2.5 │
│ @angular/platform-browser-dynamic │ 21.2.5 │ ^21.2.5 │
│ @angular/platform-server │ 21.2.5 │ ^21.2.5 │
│ @angular/router │ 21.2.5 │ ^21.2.5 │
│ @angular/service-worker │ 21.2.5 │ ^21.2.5 │
│ @angular/ssr │ 21.2.3 │ ^21.2.3 │
│ rxjs │ 7.8.2 │ ~7.8.2 │
│ typescript │ 5.9.3 │ ~5.9.3 │
│ webpack │ 5.105.2 │ ^5.63.0 │
│ zone.js │ 0.15.1 │ ^0.15.1 │
└───────────────────────────────────┴───────────────────┴───────────────────┘
Anything else?
No response