Does trusted_host_patterns support sub-directories?
Those patterns are used to check the host passed in the headers, so they cannot contain a subdirectory, since that is not passed as host. See the code in Request::getHost().

public function getHost() 
 {
  if ($this-&gt;isFromTrustedProxy() &amp;&amp; self::$trustedHeaders[self::HEADER_CLIENT_HOST] &amp;&amp; $host = $this-&gt;headers-&gt;get(self::$trustedHeaders[self::HEADER_CLIENT_HOST])) {
    $elements = explode(',', $host);

    $host = $elements[count($elements) - 1];
  }
  elseif (!$host = $this-&gt;headers-&gt;get('HOST')) {
    if (!$host = $this-&gt;server-&gt;get('SERVER_NAME')) {
      $host = $this-&gt;server-&gt;get('SERVER_ADDR', '');
    }
  }

  // trim and remove port number from host
  // host is lowercase as per RFC 952/2181
  $host = strtolower(preg_replace('/:\d+$/', '', trim($host)));

  // as the host can come from the user (HTTP_HOST and depending on the configuration, SERVER_NAME too can come from the user)
  // check that it does not contain forbidden characters (see RFC 952 and RFC 2181)
  // use preg_replace() instead of preg_match() to prevent DoS attacks with long host names
  if ($host &amp;&amp; '' !== preg_replace('/(?:^\[)?[a-zA-Z0-9-:\]_]+\.?/', '', $host)) {
    throw new \UnexpectedValueException(sprintf('Invalid Host "%s"', $host));
  }

  if (count(self::$trustedHostPatterns) &gt; 0) {
    // to avoid host header injection attacks, you should provide a list of trusted host patterns

    if (in_array($host, self::$trustedHosts)) {
      return $host;
    }

    foreach (self::$trustedHostPatterns as $pattern) {
      if (preg_match($pattern, $host)) {
        self::$trustedHosts[] = $host;

        return $host;
      }
    }

    throw new \UnexpectedValueException(sprintf('Untrusted Host "%s"', $host));
  }

  return $host;
}