Trust proxy-derived host information
Reverse-proxy deployment
Auth.js · Pipe
trustHost
trustHost is an optional boolean that lets Auth.js rely on the request’s host header when the deployment safely controls it. Set it to true for trusted deployments, especially behind a trusted proxy.
How it works
trustHost tells Auth.js that the incoming request host is safe to use. Enable it only when the deployment platform safely sets the host header; Auth.js integrations may enable it automatically on recognized platforms.
Syntax
trustHost?: booleanParameters
| Name | Type | Description |
|---|---|---|
trustHost | boolean | Whether Auth.js may trust the incoming request host header. |
Key points
- The option is an optional boolean in the Auth.js configuration.
- Auth.js uses the request host header as part of its request processing.
- Set it to true when the request host is known to be trustworthy.
- Supported official integrations can infer the setting automatically for recognized safe platforms.
- True restricts Auth.js cookies to HTTPS access.
Common mistakes
- Do not enable this option unless the deployment platform controls the host header safely.
- Local HTTP development defaults to false, so behavior can differ from HTTPS deployments.
- Disabling the HTTPS-only cookie behavior is possible, but the documentation does not recommend it.
Example: Enable trustHost
import { Auth } from "@auth/core"
const request = new Request("https://example.com")
const response = await Auth(request, {
providers: [Google],
secret: "...",
trustHost: true,
})Pass trustHost: true when Auth.js should accept the request host header as trustworthy.
When to use it
Use automatic platform detection
Recognized hosting platform
Require HTTPS-only authentication cookies
HTTPS production application
Interview questions
QWhat does trustHost control?
trustHost is a boolean Auth.js configuration property. It must be true when Auth.js relies on the incoming request's host header, provided the deployment platform sets that header safely.
Follow-up: What happens behind a proxy? Set trustHost: true, or use AUTH_TRUST_HOST=true, so Auth.js can trust proxy-provided host information when the proxy is trusted.
QHow does trustHost affect cookies?
When true, cookies created by Auth.js are accessible only over HTTPS URLs. For HTTP URLs such as local development, the option defaults to false for convenience.
Follow-up: How can insecure local cookies be allowed explicitly? Set trustHost: false, although the documentation says this is not recommended.
QWhen can Auth.js set this value automatically?
Auth.js-based libraries may infer this setting automatically for hosting platforms known to set the host header safely, such as Vercel. Otherwise, configure it explicitly in the Auth.js options.
Follow-up: Which environment variable has the same purpose? AUTH_TRUST_HOST=true is the environment-variable equivalent of trustHost: true.
Related
AUTH_TRUST_HOSThost headerX-Forwarded-HostUntrustedHostAuthConfig