Repository navigation

feat: add allowedOrigins option - #5770

Merged

alexander-akait merged 13 commits into

mainfrom

fix/allowed-origins

Oct 20, 2026

Merged

feat: add allowedOrigins option#5770
alexander-akait merged 13 commits into
mainfrom
fix/allowed-origins

Commits on Oct 20, 2026
- fix: separate origin authorization from allowed hosts
  
  bjohansebas
  authored and
  alexander-akait
  committed
  366d575
- test: clarify origin configuration coverage
  
  bjohansebas
  authored and
  alexander-akait
  committed
  8afe3c7
- fix: support HMR on a separate port
  
  bjohansebas
  authored and
  alexander-akait
  committed
  4a2ed6d
- feat: keep "auto" origins as they were, deny secrets in static, accept the hot token
  
  alexander-akait
  and
  claude
  committed
  0086d00
- chore: note what the next major release removes from the origin rules
  
  alexander-akait
  and
  claude
  committed
  3fda83e
- fix: keep the CommonJS build's injected require usable in hotOptions
  
  alexander-akait
  and
  claude
  committed
  8f8d6ca
- chore: regenerate types
  
  alexander-akait
  and
  claude
  committed
  a68d7a6
- docs: describe a list's hostname rule and the token's middleware requirement
  
  alexander-akait
  and
  claude
  committed
  cb84ac4
- feat: answer an allowed origin's preflight and credentialed requests
  
  alexander-akait
  and
  claude
  committed
  7229066
- test: cover the token, static.deny's edge cases and the list without a Host
  
  alexander-akait
  and
  claude
  committed
  5995c98
- fix: give credentials to listed origins only
  
  alexander-akait
  and
  claude
  committed
  14799d6
- chore: say in the TODOs to bump webpack-dev-middleware for the optional token
  
  alexander-akait
  and
  claude
  committed
  e2bd2e3
- feat: require webpack-dev-middleware 8.5.0 and hand the token over with allowedOrigins
  
  alexander-akait
  and
  claude
  committed
  e610267

Commits

Commits on Oct 20, 2026