Repository navigation
feat: add allowedOrigins option - #5770
bjohansebas wants to merge 3 commits into
Conversation
🦋 Changeset detectedLatest commit: c6467d1 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
WalkthroughThe change adds Priority: ➖ Normal Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Docstring Coverage |  |
Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 18 files. (2 skipped: 2… | Write docstrings for the functions missing them to satisfy the coverage threshold. |
-
Check name Status Explanation Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly and concisely identifies the primary change: adding the allowedOriginsoption.
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 18 files. (2 skipped: 2 unsupported.)
Resolution
Write docstrings for the functions missing them to satisfy the coverage threshold.
- Fix all pre-merge checks with AI
✨ Finishing Touches: 💡 1
-
📝 Generate docstrings: 💡
-
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
ℹ️ Review info
⚙️ Run configuration
- Configuration used: Organization UI
- Review profile: CHILL
- Plan: Advanced
- Run ID:
a770a2e0-d86a-4f33-90f4-0fa076fe7c75
📒 Files selected for processing: 27
.changeset/independent-origin-authorization.mdREADME.mdexamples/allowed-origins/README.mdexamples/allowed-origins/app.jsexamples/allowed-origins/webpack.config.jslib/Server.jslib/options.check.jslib/options.jsontest/__snapshots__/normalize-options.test.js.snap.webpack5test/__snapshots__/validate-options.test.js.snap.webpack5test/cli/__snapshots__/basic.test.js.snap.webpack5test/cli/allowedOrigins-option.test.jstest/e2e/__snapshots__/allowed-hosts.test.js.snap.webpack5test/e2e/allowed-hosts.test.jstest/e2e/allowed-origins.test.jstest/e2e/cross-origin-request.test.jstest/e2e/event-source.test.jstest/e2e/options-middleware.test.jstest/e2e/proxy-web-socket-origin.test.jstest/e2e/web-socket-server-url.test.jstest/normalize-options.test.jstest/ports-map.jstest/schema-check.test.jstest/server/allowed-origins.test.jstest/server/proxy-option.test.jstest/validate-options.test.jstypes/lib/Server.d.ts
Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #5770 +/- ##
==========================================
+ Coverage 95.14% 95.29% +0.14%
==========================================
Files 6 6
Lines 5009 5032 +23
==========================================
+ Hits 4766 4795 +29
+ Misses 243 237 -6 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
1 participant
Add
devServer.allowedOriginsto configure which HTTP(S) origins may access resources, HMR connections (WebSocket/SSE), and WebSocket proxies, independently ofallowedHostsandclient.webSocketURL.The default allows the same origin. Additional origins must match their scheme, hostname, and port;
"all"explicitly allows any origin while preserving host validation. The server supplies CORS headers for authorized origins.HMR on a separate port also accepts pages from this dev server's HTTP(S) listener on the same hostname. It uses the actual bound port, including with
port: 0. This exception is limited to HMR; other HTTP endpoints and WebSocket proxies retain their origin checks.Cross-origin frontends and reverse proxies that change the public origin must configure
allowedOrigins. Script and image elements loading resources across origins should usecrossorigin="anonymous"so the browser sendsOrigin. Response headers alone no longer authorize an origin, and loopback aliases and different ports are treated as distinct origins. Webpack-generated lazy chunks and hot-update scripts needoutput.crossOriginLoading: "anonymous", withoutput.publicPathresolving to the dev server.Includes CLI support, generated schema and types, documentation with an example, HTTP/browser/HMR/proxy coverage, and a minor changeset.
Validation:
main.Summary by CodeRabbit
--allowed-originsand--allowed-origins-resetCLI options. Setting origins toalldisables origin checks without disabling host validation.