# Fix Angular ng serve “Blocked request. This host is not allowed” > ng serve runs on Vite and blocks tunnel hostnames. Add .qurl.site or your tunnel’s domain to allowedHosts in angular.json, then restart ng serve. Source: https://layerv.ai/guides/fix-angular-blocked-request-allowed-hosts/ --- [← All guides](https://layerv.ai/guides/) # Fix Angular ng serve “Blocked request. This host is not allowed” Content updated October 24, 2026. ## Why does ng serve say “Blocked request. This host is not allowed” when I open my app through a tunnel? Angular’s Vite-based ng serve blocks unknown hosts. Add the tunnel domain, such as .qurl.site, to allowedHosts in the serve target’s angular.json options, then restart. The boolean --allowed-hosts flag turns the check off; avoid it. With qURL™, share the running ng serve app through single-use links that expire on their own, with no public URL. If you later need one permanent public hostname, ngrok’s dev domain fits. ## What you need - An Angular app on the Vite-based dev server (@angular/build:dev-server), opened through a tunnel or qURL link - Your angular.json ## Steps 1. ### Read the host from the error The page answers 403 and says: “Blocked request. This host ("c-k3j2ab.qurl.site") is not allowed. To allow this host, add it to allowedHosts under the serve target in angular.json.” It suggests that exact host. Allow the tool’s domain instead, so the next link works too. 2. ### Add the tool’s domain to allowedHosts in angular.json The option sits under projects..architect.serve.options. A leading dot allows the domain and every subdomain: .qurl.site for qURL, your exact dev domain for ngrok (your-domain.ngrok-free.app), .trycloudflare.com for a Cloudflare Quick Tunnel. ``` "serve": { "builder": "@angular/build:dev-server", "options": { "allowedHosts": [".qurl.site"] } } ``` 3. ### Restart ng serve on 127.0.0.1, then share it ng serve reads angular.json only at start-up, so restart it after editing. With no --host it can listen only on the IPv6 address \[::1\], depending on localhost resolution, while qurl publish connects to 127.0.0.1, so start it with --host 127.0.0.1\. Each qurl share link opens once and expires within 24 hours. ``` ng serve --host 127.0.0.1 qurl publish http://127.0.0.1:4200 qurl share ``` ## What the recipient sees With the domain allowed, the page loads through the link and hot reload connects. ## Which tool should carry your ng serve dev server? | Option | Choose it when | Trade-off | | --------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- | | [qURL](https://layerv.ai/cli/) | qURL fits when particular people should try the Angular app: one .qurl.site entry covers every qURL link, page and hot reload, with no account. | qURL reaches ng serve on 127.0.0.1, so start it with --host 127.0.0.1, and each qurl share link opens once. | | [ngrok](https://layerv.ai/compare/qurl-vs-ngrok/) | ngrok fits when you want one stable URL: your ngrok dev domain stays the same, so one exact allowedHosts entry lasts. | ngrok needs an account and authtoken, the URL is public, and free-plan browser visitors see a warning page first. | | [Cloudflare Quick Tunnels](https://layerv.ai/compare/qurl-vs-cloudflare-quick-tunnels/) | A Cloudflare Quick Tunnel fits a no-account look: .trycloudflare.com covers the hostname that changes every run. | A Cloudflare Quick Tunnel URL is public unless you set --allowed-mail, and Quick Tunnels do not support Server-Sent Events. | ## Troubleshooting | If you see | Do this | | ---------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Still “Blocked request” after editing angular.json | Restart ng serve: it reads angular.json only at start-up. Check you edited the serve target of the project you are running. | | \--allowed-hosts on the command line lets every host in | In Angular CLI 22 the flag is a yes-or-no switch that turns the host check off; it takes no list. Remove it and list the domains in angular.json. | | qurl publish says the local app is not accepting TCP connections | Start the app first and check that curl works on the same address. qurl publish connects to localhost as 127.0.0.1, so if your app listens only on IPv6 (on macOS or Linux, lsof -iTCP -sTCP:LISTEN -nP shows \[::1\]), publish 'http://\[::1\]:PORT' instead, or start the dev server with --host 127.0.0.1 and publish that address. Neither requires listening on your LAN. Keep the quotes: zsh treats the brackets as a pattern. | | The recipient sees “Access link invalid” | The link was already used or has expired. Run qurl share again and send the new link. | | The recipient sees “Resource not found” | The resource was deleted after the link was made. Publish the app again, then run qurl share and send the new link. | | publish rejects http://127.0.0.1 with “only HTTPS URLs are allowed”, or asks you to log in | You have a CLI older than 3.0\. On macOS run brew update, then brew upgrade qurl; elsewhere install the latest release again. After updating, qurl --version should print 3.4.1 or later. | | publish prints no Access: line, or the Access: line says public and you did not ask for public | With no Access: line, the CLI is older than 3.4.1: on macOS run brew update, then brew upgrade qurl; elsewhere install the latest release again. A resource that an older CLI published is public unless you published it with --private, and anyone who has the CRID of a public resource can open it. To make a public resource private, run qurl delete and publish again with qurl 3.4.1 or later. The new resource is private and has a new CRID. | | publish says this Linux session “can’t reach a systemd user manager” | You are in a container or sandbox without a user service manager. Run qurl publish with --foreground; sharing lasts as long as that process runs. | | publish says “Quota Exceeded” with “protected resource limit reached”, or “Your qURL account has reached a plan limit” | You can see this without an account: a device with no account can keep up to 3 active resources, with links that last up to 24 hours. Run qurl list --status active, then qurl delete for any you no longer need (it asks you to confirm; --yes skips that). qurl stop keeps the resource, so it does not free a slot. | ## Frequently Asked Questions Which Angular versions have allowedHosts? The option first appears in the published @angular/build 19.1.5 and 18.2.14, released with the Vite versions that added the host check. Earlier releases have no allowedHosts option on the dev server. Why not use --allowed-hosts? Because it allows every host. Vite’s docs warn that allowing all hosts lets any website send requests to your dev server through DNS rebinding and download your source code. List the domains you need in angular.json. Which domain do I add for qURL? .qurl.site. A qURL link opens the app on a qurl.site subdomain, and the leading dot covers every one of them. Who else can reach my app while the link is open? Opening the link admits the network address it was opened from for the session, which lasts 1 hour by default. Other devices that share that public IP address, such as people on the same office or café network or VPN, can reach the app until the session ends. By default a link admits whoever opens it; access rules set through the API, such as IP allow and deny lists, can restrict that. Keep your app’s own sign-in for anything sensitive. ## Related Resources [Guide: Allow a tunnel’s hostname in your dev server →](https://layerv.ai/guides/allow-tunnel-hostname-in-dev-server/) [Guide: Fix Vite “Blocked request” →](https://layerv.ai/guides/fix-vite-blocked-request-host-not-allowed/) [Guide: Fix hot reload through a tunnel →](https://layerv.ai/guides/fix-hot-reload-through-a-tunnel/) [Angular docs: ng serve ↗](https://angular.dev/cli/serve) [Vite docs: server.allowedHosts ↗](https://vite.dev/config/server-options) ## Publish your app now Install the CLI, then run one command. No sign-up, no API key. [Install the CLI ↗](https://layerv.ai/cli/) --- *This markdown version is auto-generated from [https://layerv.ai/guides/fix-angular-blocked-request-allowed-hosts/](https://layerv.ai/guides/fix-angular-blocked-request-allowed-hosts/) for AI agents. Curated agent resources: [llms.txt](https://layerv.ai/llms.txt). For the full interactive experience, visit the HTML version.*