Skip to content

Added server.allowed hosts to vite config. Fixes #6175 #6176

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
technicallynick wants to merge 1 commit into
base: main
Choose a base branch
from
+219 −0
Open

Added server.allowed hosts to vite config. Fixes #6175 #6176

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions examples/lit/basic/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/lit/filters/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/lit/row-selection/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/lit/sorting-dynamic-data/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/lit/sorting/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/lit/virtualized-rows/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/qwik/basic/vite.config.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@ import { qwikVite } from '@builder.io/qwik/optimizer'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
qwikVite({
csr: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/qwik/filters/vite.config.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@ import { qwikVite } from '@builder.io/qwik/optimizer'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
qwikVite({
csr: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/qwik/row-selection/vite.config.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@ import { qwikVite } from '@builder.io/qwik/optimizer'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
qwikVite({
csr: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/qwik/sorting/vite.config.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@ import { qwikVite } from '@builder.io/qwik/optimizer'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
qwikVite({
csr: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/react/basic/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/react/bootstrap/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/react/column-dnd/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/react/column-groups/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/react/column-ordering/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/react/column-pinning-sticky/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/react/column-pinning/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/react/column-resizing-performant/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/react/column-sizing/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/react/column-visibility/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/react/custom-features/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/react/editable-data/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/react/expanding/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/react/filters-faceted/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/react/filters-fuzzy/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/react/filters/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/react/full-width-resizable-table/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/react/full-width-table/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/react/fully-controlled/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/react/grouping/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/react/kitchen-sink/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/react/material-ui-pagination/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/react/pagination-controlled/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/react/pagination/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/react/query-router-search-params/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,9 @@ import { TanStackRouterVite } from '@tanstack/router-vite-plugin'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
Comment on lines +8 to +10
Copy link

@coderabbitai coderabbitai bot Feb 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🌐 Web query:

Vite server.allowedHosts configuration true boolean

💡 Result:

In Vite, server.allowedHosts supports a boolean true value.

  • Type: string[] | true (default: []) (main.vitejs.dev)
  • Meaning of true: the dev server will respond to requests for any Host header (i.e., no host allowlist enforcement). (main.vitejs.dev)
  • Security warning: setting it to true is not recommended because it can enable DNS rebinding attacks (leaking your dev server content/source). Prefer an explicit list. (main.vitejs.dev)

Example:

// vite.config.js
import { defineConfig } from 'vite'

export default defineConfig({
  server: {
    allowedHosts: true,
  },
})

Note: there’s at least one report that allowedHosts: true didn’t behave as expected in Vite 6.0.9 (issue closed “not planned”). (github.com)

Citations:

Add a clarifying comment and consider version compatibility.

allowedHosts: true is valid Vite syntax (type: string[] | true), but Vite's documentation explicitly warns against this setting because it enables DNS rebinding attacks. For CodeSandbox compatibility, consider adding a code comment explaining this security tradeoff, or use an explicit host allowlist instead. Also note that Vite 6.0.9 had a reported issue where allowedHosts: true didn't behave as expected (may want to test in your target Vite version).

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@examples/react/query-router-search-params/vite.config.js` around lines 8 -
10, The server.allowedHosts setting currently uses allowedHosts: true which is
valid but insecure; update the vite.config.js to add a clarifying comment next
to server.allowedHosts explaining the DNS rebinding risk and that true is used
for CodeSandbox compatibility, and replace it with an explicit host allowlist
(string[] of allowed hosts) where possible; also add a note about testing
against Vite versions (e.g., v6.0.9) because that version had reports of
allowedHosts:true not behaving as expected so verify behavior in your target
Vite release.

plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/react/row-dnd/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/react/row-pinning/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/react/row-selection/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/react/sorting/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
3 changes: 3 additions & 0 deletions examples/react/sub-components/vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ import rollupReplace from '@rollup/plugin-replace'

// https://vitejs.dev/config/
export default defineConfig({
server: {
allowedHosts: true,
},
plugins: [
rollupReplace({
preventAssignment: true,
Expand Down
Loading