Repository navigation
feat: add allowedOrigins option - #5770
bjohansebas wants to merge 14 commits into
Conversation
🦋 Changeset detectedLatest commit: 3d3355d The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the
Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
WalkthroughThe server adds Priority: ➖ Normal Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Docstring Coverage |  |
Docstring coverage is 14.29% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 28 functions across 24 files. (4 skipped:… | Write docstrings for the functions missing them to satisfy the coverage threshold. |
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly and concisely identifies the primary change: adding the allowedOriginsoption.Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 14.29% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 28 functions across 24 files. (4 skipped: 4 unsupported.)
Resolution
Write docstrings for the functions missing them to satisfy the coverage threshold.
- Fix all pre-merge checks with AI
✨ Finishing Touches: 💡 1
-
📝 Generate docstrings: 💡
-
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
ℹ️ Review info
⚙️ Run configuration
- Configuration used: Organization UI
- Review profile: CHILL
- Plan: Advanced
- Run ID:
a770a2e0-d86a-4f33-90f4-0fa076fe7c75
📒 Files selected for processing: 27
.changeset/independent-origin-authorization.mdREADME.mdexamples/allowed-origins/README.mdexamples/allowed-origins/app.jsexamples/allowed-origins/webpack.config.jslib/Server.jslib/options.check.jslib/options.jsontest/__snapshots__/normalize-options.test.js.snap.webpack5test/__snapshots__/validate-options.test.js.snap.webpack5test/cli/__snapshots__/basic.test.js.snap.webpack5test/cli/allowedOrigins-option.test.jstest/e2e/__snapshots__/allowed-hosts.test.js.snap.webpack5test/e2e/allowed-hosts.test.jstest/e2e/allowed-origins.test.jstest/e2e/cross-origin-request.test.jstest/e2e/event-source.test.jstest/e2e/options-middleware.test.jstest/e2e/proxy-web-socket-origin.test.jstest/e2e/web-socket-server-url.test.jstest/normalize-options.test.jstest/ports-map.jstest/schema-check.test.jstest/server/allowed-origins.test.jstest/server/proxy-option.test.jstest/validate-options.test.jstypes/lib/Server.d.ts
Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #5770 +/- ##
==========================================
+ Coverage 95.15% 95.63% +0.48%
==========================================
Files 6 6
Lines 5016 5526 +510
==========================================
+ Hits 4773 5285 +512
+ Misses 243 241 -2 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UjuMAuk9o6UazjHzcAQCTA
…t the hot token `allowedOrigins: "auto"` (the default) now keeps the origin rules derived from `allowedHosts` exactly, so nothing changes until the option is set; `allowedHosts: "all"` and an `Access-Control-Allow-Origin: *` header still open every origin under it, with a deprecation warning. A list allows the page's own hostname plus the listed origins, answers them with CORS headers and allows a plain script they load by its `Referer`; "all" allows every origin and keeps the `Host` check. One rule now serves ordinary requests, proxied WebSocket upgrades, hot clients and the internal endpoints. The injected hot client is handed a per-run token the endpoint does not require (webpack-dev-middleware#2486), and a client carrying it may connect from an origin the server does not know; skipped with an older middleware. `static.deny` refuses secrets (`.env*`, keys and certificates, `.npmrc`, `.yarnrc.yml`, `.git`) or patterns of your own in a static directory, and hides them from listings; off by default until the next major. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UjuMAuk9o6UazjHzcAQCTA
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UjuMAuk9o6UazjHzcAQCTA
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UjuMAuk9o6UazjHzcAQCTA
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UjuMAuk9o6UazjHzcAQCTA
There was a problem hiding this comment.
Actionable comments posted: 2
ℹ️ Review info
⚙️ Run configuration
- Configuration used: Organization UI
- Review profile: CHILL
- Plan: Advanced
- Run ID:
35fd4aa8-3b41-48b8-9409-38c2ebfee855
📒 Files selected for processing: 20
.changeset/independent-origin-authorization.md.cspell.jsonREADME.mdexamples/allowed-origins/README.mdexamples/allowed-origins/webpack.config.jslib/Server.jslib/hotOptions.jslib/options.check.jslib/options.jsontest/__snapshots__/normalize-options.test.js.snap.webpack5test/__snapshots__/validate-options.test.js.snap.webpack5test/cli/__snapshots__/basic.test.js.snap.webpack5test/e2e/allowed-origins.test.jstest/e2e/static-deny.test.jstest/hot-options.test.jstest/ports-map.jstest/server/allowed-origins-deprecation.test.jstest/server/allowed-origins.test.jstest/validate-options.test.jstypes/lib/Server.d.ts
🚧 Files skipped from review as they are similar to previous changes: 2
- .changeset/independent-origin-authorization.md
- test/cli/snapshots/basic.test.js.snap.webpack5
Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.
…irement Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UjuMAuk9o6UazjHzcAQCTA
With allowedOrigins set, a listed origin gets Access-Control-Allow-Credentials, and an allowed origin's preflight gets the method, headers and Private Network Access it asks for, so a fetch with custom headers, another method or cookies works from it. "auto" is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UjuMAuk9o6UazjHzcAQCTA
There was a problem hiding this comment.
Actionable comments posted: 1
ℹ️ Review info
⚙️ Run configuration
- Configuration used: Organization UI
- Review profile: CHILL
- Plan: Advanced
- Run ID:
39a7947f-74d3-4927-a3f1-0bce7d63078a
📒 Files selected for processing: 4
README.mdexamples/allowed-origins/README.mdlib/Server.jstest/e2e/allowed-origins.test.js
🚧 Files skipped from review as they are similar to previous changes: 1
- examples/allowed-origins/README.md
Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 6 remain after this review.
…a Host The hot-token tests now give the middleware a token when it has none, so this server's own check runs on any webpack-dev-middleware rather than being skipped; the optional-token detection takes a schema and is tested on its own. static.deny gets the `?` glob, an undecodable path and the Windows rules. The allowedOrigins entry check the schema already makes is gone, and the token is read off the query without a try that cannot fail. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UjuMAuk9o6UazjHzcAQCTA
A list also allows the page's own hostname on any port, and cookies do not tell ports apart, so Access-Control-Allow-Credentials went to any other local page with it. It now goes only to an origin listed by name. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UjuMAuk9o6UazjHzcAQCTA
|
@coderabbitai review Generated by Claude Code |
✅ Action performedReview finished.
|
…al token Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UjuMAuk9o6UazjHzcAQCTA
…th allowedOrigins
8.5.0 takes `hot.token: { required: false }` (webpack/webpack-dev-middleware#2486),
so the check for it, the tests' stand-in token and the README notes on older
versions go, as their TODOs said. The token is handed to the injected client
only once `allowedOrigins` is set: under "auto" the socket's url and who it
lets in stay exactly as before, with a TODO to always hand it over in the
next major release.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UjuMAuk9o6UazjHzcAQCTA
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
@coderabbitai review Generated by Claude Code |
✅ Action performedReview finished.
|
2 participants
Add
devServer.allowedOriginsto say which pages may use the dev server: its HTTP endpoints, hot module replacement (WebSocket or Server-Sent Events), proxied WebSockets and the internal endpoints. It is separate fromallowedHosts, which checks theHostheader (DNS rebinding).Non-breaking. Nothing changes until the option is set.
"auto"(default): the rules derived fromallowedHosts, exactly as before.main's own security tests (allowed-hosts,cross-origin-request,event-source,options-middleware,proxy-web-socket-origin,web-socket-server-url,proxy-option) are left unchanged and pass. Under"auto", two settings still open every origin, as they always have:allowedHosts: "all", and anAccess-Control-Allow-Origin: *entry inheaders(which turns offCross-Origin-Resource-Policy). Both now print a deprecation warning.allowedHostssays.Access-Control-Allow-Origin,Access-Control-Allow-CredentialsandVary: Origin, and their preflight requests get the method, headers and Private Network Access they ask for.<script>or<img>withoutcrossoriginis allowed by the page'sReferer, and getsCross-Origin-Resource-Policy: cross-origin.Origin, gets403."all": every origin, withAccess-Control-Allow-Origin: *; theHostcheck stays on.One internal rule now serves ordinary requests, proxied WebSocket upgrades, hot clients and the open-editor/invalidate endpoints.
Hot token (as in Vite). Once
allowedOriginsis set, the injected client is handed a per-run token. A hot client that carries it may connect from an origin the server does not otherwise know, such as a proxy's or a tunnel's. It never replaces theHostcheck. This useshot.token: { required: false }from webpack-dev-middleware 8.5.0 (webpack/webpack-dev-middleware#2486), which is now the minimum (^8.5.0). Under"auto"there is no token, so the socket URL and who it lets in are exactly as before. A TODO makes it unconditional in the next major.static.deny. Off by default.truerefuses.env,.env.*,*.{crt,pem,key,p12,pfx,cer,der},.npmrc,.yarnrc.ymland.gitin a static directory with403, and leaves them out of directory listings.*,?,{a,b}) refuses those instead.:(alternate data streams) and trailing dots and spaces.Next major (TODOs in code).
"auto"and defaultallowedOriginsto[].allowedHostsandheadersstop granting origins, and the deprecations and legacy checks are removed.client.webSocketURL.hostnamestops being an allowed host.static.denydefaults totrue.Docs: a README "Security" section (
allowedOrigins,static.deny), the rewrittenexamples/allowed-origins, and a minor changeset.Tests:
test/server/allowed-origins.test.js,test/server/allowed-origins-deprecation.test.js,test/e2e/allowed-origins.test.js(HTTP, HMR, endpoints, a real browser loading a plain script from a listed and an unlisted page, the token),test/e2e/static-deny.test.js.mainin the same sandbox: no new failures; the remaining 51 are the same set asmain(IPv6, proxy 403, a non-local IP).https://claude.ai/code/session_01UjuMAuk9o6UazjHzcAQCTA
Generated by Claude Code
Summary by CodeRabbit
allowedOriginssettings to control which website origins can access the development server, including options to use existing host rules, allow specified origins, or allow all origins while retaining Host checks.static.denyto block sensitive files with a 403 response and hide them from directory listings, with support for custom patterns.