fix(middleware): restore host-port stripping in AllowedHostsMiddleware

[chuenchen309]

What

A request whose Host header includes a port (e.g. example.com:8080) is incorrectly rejected with 400 by AllowedHostsMiddleware, even when the bare hostname (example.com) is present in allowed_hosts.

Root cause

Commit c418961 ("fix: fix typing after merge") changed:

if host := headers.get("host").split(":")[0]:

into:

if (host := headers.get("host")) is not None and host.split(":")[0]:

The walrus assignment now binds host to the full header value (including any port), and host.split(":")[0] is only used for a truthiness check — its result is discarded. So self.allowed_hosts_regex.fullmatch(host) downstream still receives the port-suffixed value, which never matches a bare-hostname regex pattern.

Fix

Rebind host via a second walrus assignment so the stripped (port-free) value is what's actually used for matching:

if (host := headers.get("host")) is not None and (host := host.split(":")[0]):

How I verified this

• Traced the regression to c418961 via git log -p --follow -- litestar/middleware/allowed_hosts.py.
• Reproduced standalone with a minimal ASGI script directly invoking AllowedHostsMiddleware.
• Added a parametrize case to the existing test_middleware_allowed_hosts test (("http://x.example.com:8080", None, HTTP_200_OK)); confirmed it fails on the current code (assert 400 == 200) before the fix.
• Applied the one-line fix, confirmed all 14 tests in test_allowed_hosts_middleware.py pass.
• Ran the full tests/unit/test_middleware/ suite: 776 passed, no regressions.
• mypy litestar/middleware/allowed_hosts.py — clean.
• pre-commit run on changed files — clean (ruff check/format, unasyncd, typos).

Disclosure

I used AI assistance (Claude) to help investigate and draft this fix, but I personally reviewed the root-cause trace, ran the repro and full test suite myself, and reviewed the final diff before submitting. Happy to answer any questions about the change.

---

📚 Documentation preview 📚: https://litestar-org.github.io/litestar-docs-preview/4922

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 67.29%. Comparing base (bd18fd4) to head (236213f).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4922   +/-   ##
=======================================
  Coverage   67.29%   67.29%           
=======================================
  Files         293      293           
  Lines       15228    15228           
  Branches     1728     1728           
=======================================
  Hits        10248    10248           
  Misses       4833     4833           
  Partials      147      147           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[chuenchen309]

Thanks for the review time on this — I found while doing some further digging that #4873 already fixes this exact regression (referencing #4869), opened back on 2026-06-20, well before my independent discovery of it today. Since it's the same root cause and fix, I'll close this one in favor of the earlier PR rather than duplicate the review effort. Apologies for not catching the existing PR before submitting — will be more careful to cross-check open PRs against the exact file path before starting work in the future.

[provinzkraut]

Thanks for the review time on this

There was no review