Skip to content

Commit 5e59da1

Browse files
ijjkhuozhiztanner
committed
Add dev warning for cross-origin and stabilize allowedDevOrigins (#77044)
Adding a warning when we block cross-origin requests in dev so users are aware this is why easier and know how to allow the origin through as custom setups can use different origins and it be valid. x-ref: #76880 (comment) --------- Co-authored-by: Jiachi Liu <[email protected]> Co-authored-by: Zack Tanner <[email protected]>
1 parent 8151cb6 commit 5e59da1

File tree

5 files changed

+36
-0
lines changed

5 files changed

+36
-0
lines changed
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
title: allowedDevOrigins
3+
description: Use `allowedDevOrigins` to configure additional origins that can request the dev server.
4+
---
5+
6+
{/* The content of this doc is shared between the app and pages router. You can use the `<PagesOnly>Content</PagesOnly>` component to add content that is specific to the Pages Router. Any shared content should not be wrapped in a component. */}
7+
8+
To configure a Next.js application to allow requests from origins other than the hostname the server was initialized with (`localhost` by default) you can use the `allowedDevOrigins` config option.
9+
10+
`allowedDevOrigins` allows you to set additional origins that can be used in development mode. For example, to use `local-origin.dev` instead of only `localhost`, open `next.config.js` and add the `allowedDevOrigins` config:
11+
12+
```js filename="next.config.js"
13+
module.exports = {
14+
allowedDevOrigins: ['local-origin.dev'],
15+
}
16+
```
17+
18+
Cross-origin requests are blocked by default to prevent unauthorized requesting of internal assets/endpoints which are available in development mode. This behavior is similar to other dev servers like `webpack-dev-middleware` to ensure the same protection.
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
title: allowedDevOrigins
3+
description: Use `allowedDevOrigins` to configure additional origins that can request the dev server.
4+
source: app/api-reference/config/next-config-js/allowedDevOrigins
5+
---
6+
7+
{/* DO NOT EDIT. The content of this doc is generated from the source above. To edit the content of this page, navigate to the source page in your editor. You can use the `<PagesOnly>Content</PagesOnly>` component to add content that is specific to the Pages Router. Any shared content should not be wrapped in a component. */}

packages/next/src/server/config-schema.ts

+1
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,7 @@ const zTurboRuleConfigItemOrShortcut: zod.ZodType<TurboRuleConfigItemOrShortcut>
128128

129129
export const configSchema: zod.ZodType<NextConfig> = z.lazy(() =>
130130
z.strictObject({
131+
allowedDevOrigins: z.array(z.string()).optional(),
131132
amp: z
132133
.object({
133134
canonicalBase: z.string().optional(),

packages/next/src/server/config-shared.ts

+3
Original file line numberDiff line numberDiff line change
@@ -673,6 +673,8 @@ export type ExportPathMap = {
673673
* Read more: [Next.js Docs: `next.config.js`](https://nextjs.org/docs/app/api-reference/config/next-config-js)
674674
*/
675675
export interface NextConfig extends Record<string, any> {
676+
allowedDevOrigins?: string[]
677+
676678
exportPathMap?: (
677679
defaultMap: ExportPathMap,
678680
ctx: {
@@ -1134,6 +1136,7 @@ export const defaultConfig: NextConfig = {
11341136
output: !!process.env.NEXT_PRIVATE_STANDALONE ? 'standalone' : undefined,
11351137
modularizeImports: undefined,
11361138
outputFileTracingRoot: process.env.NEXT_PRIVATE_OUTPUT_TRACE_ROOT || '',
1139+
allowedDevOrigins: [],
11371140
experimental: {
11381141
allowedDevOrigins: [],
11391142
nodeMiddleware: false,

packages/next/src/server/lib/router-utils/block-cross-site.ts

+7
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ import type { Duplex } from 'stream'
22
import type { IncomingMessage, ServerResponse } from 'webpack-dev-server'
33
import { parseUrl } from '../../../lib/url'
44
import net from 'net'
5+
import { warnOnce } from '../../../build/output/log'
56

67
export const blockCrossSite = (
78
req: IncomingMessage,
@@ -23,6 +24,9 @@ export const blockCrossSite = (
2324
res.statusCode = 403
2425
}
2526
res.end('Unauthorized')
27+
warnOnce(
28+
`Blocked cross-origin request to /_next/*. To allow this, configure "allowedDevOrigins" in next.config\nRead more: https://nextjs.org/docs/app/api-reference/config/next-config-js/allowedDevOrigins`
29+
)
2630
return true
2731
}
2832

@@ -50,6 +54,9 @@ export const blockCrossSite = (
5054
res.statusCode = 403
5155
}
5256
res.end('Unauthorized')
57+
warnOnce(
58+
`Blocked cross-origin request from ${originLowerCase}. To allow this, configure "allowedDevOrigins" in next.config\nRead more: https://nextjs.org/docs/app/api-reference/config/next-config-js/allowedDevOrigins`
59+
)
5360
return true
5461
}
5562
}

0 commit comments

Comments
 (0)