werkzeug.BaseRequest.trusted_hosts¶

BaseRequest.trusted_hosts = None¶

Optionally a list of hosts that is trusted by this request. By default all hosts are trusted which means that whatever the client sends the host is will be accepted.

This is the recommended setup as a webserver should manually be set up to only route correct hosts to the application, and remove the X-Forwarded-Host header if it is not being used (see werkzeug.wsgi.get_host()).