Skip to content

feat(dev-server): support allowedHosts - #178

Closed
lukekania wants to merge 2 commits into
milestone/v0.11.0-builder-parityfrom
feat/dev-server-allowed-hosts
Closed

feat(dev-server): support allowedHosts#178
lukekania wants to merge 2 commits into
milestone/v0.11.0-builder-parityfrom
feat/dev-server-allowed-hosts

Conversation

@lukekania

Copy link
Copy Markdown
Owner

Closes #144.

lukekania added 2 commits May 18, 2026 10:27
…lhost) (#144)

Add the `allowedHosts` knob the `@angular/build:dev-server` builder
exposes so projects fronted by a tunneling proxy (ngrok, Cloudflare
Tunnel, GitHub Codespaces) or running under a non-default local
hostname (`*.localhost`, `app.local`) don't get rejected by the dev
server's `Host:` header check.

* `packages/builder/schemas/dev-server.json`: add `allowedHosts: array`.
* `packages/builder/src/serve/options.ts`: forward the list as
  `--allowed-hosts host1,host2`, normalizing empty/whitespace entries
  and case-insensitively deduping.
* `crates/cli`: new `--allowed-hosts` flag on `ngc-rs serve` (value
  delimiter `,`) wired through `serve_cmd::run` to the dev server.
* `crates/dev-server`: new `AllowedHosts` resolver + filter in
  `handle_request`. Loopback hosts (`localhost`, `127.0.0.1`, `[::1]`)
  are always allowed. The literal `"all"` disables the check entirely;
  `"auto"` (or an empty list, the default) additionally accepts the
  bound host. Anything else is an exact, case-insensitive hostname
  match with the `Host:`-header port stripped before comparison.
  Mismatches respond with a 403 whose body names the offending host
  and points at both the angular.json option and the CLI flag.

Bumps workspace version to 0.10.12.
@lukekania

Copy link
Copy Markdown
Owner Author

Superseded by #173 (reopened) which has the full PR description.

@lukekania lukekania closed this May 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant