-
Notifications
You must be signed in to change notification settings - Fork 214
Webpack Dev Server host check issue with 0.0.0.0 #187
Comments
Hmm, I'm not sure that any of those 3 solutions are the correct answer. Choosing any of those sounds like they could leave a local app vulnerable, and if we are opting for smart defaults, I would prefer to err on the side of secure over convenient. @edmorley any thoughts? |
I guess option 4, implied by @constgen, would be to allow the user to set |
I've filed a retrospective GitHub issue with the original private disclosure email wording, which should hopefully make things a bit clearer: webpack/webpack-dev-server#887 - happy to answer any additional questions. I've added some comments to webpack/webpack-dev-server#882 as to ways that the security check can be adjusted to require less configuration in common cases. |
Ok. I will try the suggestions and report here |
Any chance we can get this in for v6? |
I would like to implement it in this version. Yes |
Have done a significant refactoring of the Webpack Dev Server usage in Neutrino. Now we have
Want to discuss one moment. |
To give an update here, the implementation from @constgen has resolved this, and I tweaked it a little since at the moment there aren't any environment variables being used.
We will come back to environment variables in a follow up issue. |
If there are issues with this, please raise them in another issue. |
Starting from v2.4.3 'webpack-dev-server' has additional security measures. It checks that listening hostname matches the hostname in the provided 'host' header (
devServer.headers = {host: '192.168.1.100'}
). As exceptions it always allowslocalhost
and127.0.0.1
.Currently the Neutrino will always fail to start the server of host is reconfigured to something different then
localhost
and127.0.0.1
, e.g.0.0.0.0
for local network access. The page will be empty with the only error message 'Invalid Host header'.What are options to resolve this issue.
devServer.disableHostCheck = false
. But this flag is not supported in thewebpack-chain
. Have to add it.host
withheaders.host
. Need to consider here that consumer also may redefine options in different ways.0.0.0.0
as allowed. Another addresses will be handled by the option 2 above or manually by the consumer.The Webpack Dev Server commit with these changes:
webpack/webpack-dev-server@2957853
Actually I see a lot of problems in the future if we will keep the dev server completely configurable by developers. In my opinion it is better to provide an abstraction with one-two flags. Ideally there should be one ultimate solution for everyone without any configuration.
The text was updated successfully, but these errors were encountered: