From dc1b2d10074126ec094d819116d46af3a2b09d43 Mon Sep 17 00:00:00 2001 From: alexander-akait <4567934+alexander-akait@users.noreply.github.com> Date: Tue, 20 Oct 2026 11:53:39 +0000 Subject: [PATCH 1/2] fix: exact own origin for allowedOrigins lists, and open-editor over the network With `allowedOrigins` set, the page's own origin is now the host and port it reached the server by, exactly, instead of its hostname on any port with the loopback names counted as one: another server's page on `localhost` could read the bundles through CORS and receive hot updates. `/webpack-dev-server/open-editor` reached through a network address now needs a same-origin `Referer` (or the hot token) when the request carries neither `Sec-Fetch-Site` nor `Origin`, which a browser omits for any `http:` page that is not on `localhost`. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01UjuMAuk9o6UazjHzcAQCTA --- .../independent-origin-authorization.md | 2 +- .changeset/open-editor-network-csrf.md | 5 ++ README.md | 17 ++-- examples/allowed-origins/README.md | 12 +-- lib/Server.js | 89 +++++++++++++++---- lib/options.check.js | 2 +- lib/options.json | 2 +- test/e2e/allowed-origins.test.js | 31 ++++++- test/server/allowed-origins.test.js | 53 ++++++++++- test/server/host-header-validation.test.js | 78 ++++++++++++++++ 10 files changed, 253 insertions(+), 38 deletions(-) create mode 100644 .changeset/open-editor-network-csrf.md diff --git a/.changeset/independent-origin-authorization.md b/.changeset/independent-origin-authorization.md index 1abba02cea..9d0f910c18 100644 --- a/.changeset/independent-origin-authorization.md +++ b/.changeset/independent-origin-authorization.md @@ -2,7 +2,7 @@ "webpack-dev-server": minor --- -Add `allowedOrigins` to say which pages may use the server — its HTTP endpoints, hot module replacement and proxied WebSockets — independently of `allowedHosts`, which goes back to checking `Host`. Nothing changes until it is set: the default, `"auto"`, keeps the rules derived from `allowedHosts`. A list allows the listed origins plus the page's own hostname (any port, loopback names counted as one, as before), answering them with CORS headers and allowing a plain `