allowedHosts doesn't allow for my-site_1.localhost type host.

[QuentinPetel]

Which @angular/* package(s) are the source of the bug?

Don't known / other

Is this a regression?

Yes

Description

I use traefik as a reverse proxy to serve an angular app at http://my-site_1.localhost on a dev environment.

After upgrading to version 21 from version 20, neither of the following strings in NG_ALLOWED_HOSTS (also tried project.browser.architect.build.options.security.allowedHosts with the same issue) allow for the use of a my-site_1.localhost type url for the host.

NG_ALLOWED_HOSTS='*,localhost,*.localhost,my-site_1.localhost' ng serve --host 0.0.0.0"

Accessing http://localhost:PORT is working. Accessing http://my-site_1.localhost throw a 400 Bad request (Header "host" contains characters that are not allowed.).

Please provide a link to a minimal reproduction of the bug

No response

Please provide the exception or error you saw

Header "host" contains characters that are not allowed.

Please provide the environment you discovered this bug in (run ng version)

Angular CLI       : 21.2.3
 Angular           : 21.2.5
 Node.js           : 20.20.1
 Package Manager   : npm 10.8.2
 Operating System  : linux arm64

 ┌───────────────────────────────────┬───────────────────┬───────────────────┐
 │ Package                           │ Installed Version │ Requested Version │
 ├───────────────────────────────────┼───────────────────┼───────────────────┤
 │ @angular-devkit/build-angular     │ 21.2.3            │ ^21.2.3           │
 │ @angular/animations               │ 21.2.5            │ ^21.2.5           │
 │ @angular/cdk                      │ 21.2.4            │ ^21.2.4           │
 │ @angular/cli                      │ 21.2.3            │ ^21.2.3           │
 │ @angular/common                   │ 21.2.5            │ ^21.2.5           │
 │ @angular/compiler                 │ 21.2.5            │ ^21.2.5           │
 │ @angular/compiler-cli             │ 21.2.5            │ ^21.2.5           │
 │ @angular/core                     │ 21.2.5            │ ^21.2.5           │
 │ @angular/forms                    │ 21.2.5            │ ^21.2.5           │
 │ @angular/language-service         │ 21.2.5            │ ^21.2.5           │
 │ @angular/platform-browser         │ 21.2.5            │ ^21.2.5           │
 │ @angular/platform-browser-dynamic │ 21.2.5            │ ^21.2.5           │
 │ @angular/platform-server          │ 21.2.5            │ ^21.2.5           │
 │ @angular/router                   │ 21.2.5            │ ^21.2.5           │
 │ @angular/service-worker           │ 21.2.5            │ ^21.2.5           │
 │ @angular/ssr                      │ 21.2.3            │ ^21.2.3           │
 │ rxjs                              │ 7.8.2             │ ~7.8.2            │
 │ typescript                        │ 5.9.3             │ ~5.9.3            │
 │ webpack                           │ 5.105.2           │ ^5.63.0           │
 │ zone.js                           │ 0.15.1            │ ^0.15.1           │
 └───────────────────────────────────┴───────────────────┴───────────────────┘

Anything else?

No response