[wrangler] Add --infer-origin-from-routes flag to opt out of route-based origin rewriting in local dev - #14865
Open
TheSaiEaranti wants to merge 1 commit into
Open
Conversation
…sed origin rewriting in local dev When routes are configured, local dev infers the origin from the first route, so the Worker sees request.url, Host, and Origin rewritten to the route's host even though the client connected to localhost. This silently breaks Host/Origin-sensitive logic: a CORS check allowlisting http://localhost:* receives http://<route-host> and rejects the request only under local dev. The inference is intentional and stays the default. The internal StartDevWorkerOptions switch (dev.inferOriginFromRoutes) already existed for the test harness; this exposes it as a documented wrangler dev flag. Passing --infer-origin-from-routes=false preserves the real local origin without removing routes from the config. An explicit --host, --local-upstream, or dev.host continues to take precedence either way. Fixes cloudflare#14683
🦋 Changeset detectedLatest commit: 9edaa7e The changes in this PR will be included in the next version bump. This PR includes changesets to release 3 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
workers-devprod
requested review from
a team and
jamesopstad
and removed request for
a team
July 26, 2026 19:39
Contributor
|
Codeowners approval required for this PR:
Show detailed file reviewers
|
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #14683.
In local
wrangler dev, a configuredroutesentry makes the Worker seerequest.url, theHostheader, and any presentOriginheader rewritten to the route's host, even though the client genuinely connected tohttp://localhost:PORT. Origin/Host-sensitive logic then behaves differently only under local dev — the issue's example is a CORS check allowlistinghttp://localhost:*that receiveshttp://<route-host>and returns 403, with no indication the headers were altered.The rewrite is intentional (it makes
request.urlmatch production routes), so this PR does not change the default. It adds the opt-out the issue asks for:Why this shape: the switch already exists internally —
StartDevWorkerOptions.dev.inferOriginFromRoutesgatesgetInferredHost()inConfigControllerand is set tofalsetoday only by the API test harness. This PR exposes that existing switch as a documentedwrangler devflag and threads it throughstart-dev.ts(and the exhaustive args object inapi/dev.ts); no behavioral logic changes. With the flag set tofalseand no explicit host,origin.hostnamestays undefined, so miniflare never rewrites and the Worker sees the real local origin. An explicit--host,--local-upstream, ordev.hostcontinues to take precedence either way — covered by a test.Tests: two new cases in the existing
local upstreamblock ofdev.test.ts: withroutesconfigured and the flag false,config.dev.origin?.hostnameisundefined(onmain, the route host); withdev.hostalso set, the explicit host still wins. Fulldev.test.ts: 203/203 pass.pnpm prettifyclean; the wrangler build (including dts) passes.--helptext and the changeset; happy to file a cloudflare-docs PR for thewrangler devpage if you'd like one.