fix(server): apply the Host check before the app's own routes

Vite installs its Host check after the middleware plugins add in
configureServer, so the provider and /api routes answered any Host,
including a DNS-rebinding name. hostCheckPlugin runs first on the dev and
preview servers and applies Vite's rule with the same allowed hosts: IP
addresses, localhost and *.localhost, the configured server host, and the
listed names. A test drives a real Vite server with an unlisted Host.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/tooling/allowedHosts.test.mjs

@@ -1,7 +1,11 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
+import { request as httpRequest } from 'node:http';
+import { fileURLToPath } from 'node:url';
 import {
   DEFAULT_ALLOWED_HOSTS,
+  hostCheckPlugin,
+  isAllowedHost,
   resolveAllowedHosts,
 } from '../../build/allowedHosts.js';
 
@@ -32,3 +36,118 @@ test('rejects suffix and wildcard entries so every LAN hostname is explicit', ()
     'globe.lan',
   ]);
 });
+
+test('a Host is allowed by the same rule Vite applies', () => {
+  const allowed = ['localhost', '127.0.0.1', 'globe.lan', '.corp.example'];
+  for (const host of [
+    'localhost:4173',
+    'LOCALHOST:4173',
+    'app.localhost',
+    '127.0.0.1:4173',
+    '192.168.1.20:4173',
+    '[::1]:4173',
+    'globe.lan:4173',
+    'corp.example',
+    'a.corp.example:8080',
+    'office:4173',
+  ])
+    assert.equal(isAllowedHost(host, allowed, ['office']), true, host);
+  for (const host of [
+    undefined,
+    '',
+    'evil.example:4173',
+    'globe.lan.evil.example',
+    'localhost.evil.example',
+    'mybox.local:4173',
+    '[not-an-ip]:4173',
+  ])
+    assert.equal(isAllowedHost(host, allowed, ['office']), false, String(host));
+  assert.equal(isAllowedHost('anything.example', true), true);
+});
+
+test('the Host check is installed first on the dev and preview servers', () => {
+  const plugin = hostCheckPlugin();
+  assert.equal(plugin.enforce, 'pre');
+  for (const hook of ['configureServer', 'configurePreviewServer']) {
+    let middleware;
+    plugin[hook]({
+      config: {
+        server: { allowedHosts: ['localhost'], host: 'localhost' },
+        preview: { allowedHosts: ['localhost'], host: undefined },
+      },
+      middlewares: { use: (fn) => (middleware = fn) },
+    });
+    const respond = (host) => {
+      const res = {
+        status: null,
+        writeHead(status) {
+          this.status = status;
+        },
+        end() {},
+      };
+      let passed = false;
+      middleware({ headers: { host } }, res, () => (passed = true));
+      return passed ? 'next' : res.status;
+    };
+    assert.equal(respond('localhost:4173'), 'next', hook);
+    assert.equal(respond('evil.example:4173'), 403, hook);
+  }
+});
+
+test('an unlisted Host cannot reach a route a plugin mounts', async (t) => {
+  const { createServer } = await import('vite');
+  const { createBrowserViteConfig } = await import('../../build/vite.js');
+  const provider = {
+    name: 'fixture-provider',
+    configureServer(server) {
+      server.middlewares.use('/api/fixture', (req, res) => {
+        res.end('provider answered');
+      });
+    },
+  };
+  const base = createBrowserViteConfig({ plugins: [provider] });
+  const vite = await createServer({
+    ...base,
+    root: fileURLToPath(new URL('../../', import.meta.url)),
+    configFile: false,
+    envFile: false,
+    publicDir: false,
+    logLevel: 'silent',
+    // Only this test's plugins: the Host check and the fixture provider.
+    plugins: base.plugins.filter((plugin) =>
+      ['host-check', 'fixture-provider'].includes(plugin?.name),
+    ),
+    optimizeDeps: { noDiscovery: true, include: [] },
+    server: {
+      ...base.server,
+      host: '127.0.0.1',
+      port: 0,
+      hmr: false,
+      watch: null,
+    },
+  });
+  await vite.listen();
+  t.after(() => vite.close());
+  const { port } = vite.httpServer.address();
+  const get = (host) =>
+    new Promise((resolve, reject) => {
+      const request = httpRequest(
+        {
+          host: '127.0.0.1',
+          port,
+          path: '/api/fixture',
+          headers: { Host: host },
+        },
+        (response) => {
+          response.resume();
+          resolve(response.statusCode);
+        },
+      );
+      request.on('error', reject);
+      request.end();
+    });
+  assert.equal(await get(`localhost:${port}`), 200);
+  assert.equal(await get(`127.0.0.1:${port}`), 200);
+  assert.equal(await get(`evil.example:${port}`), 403);
+  assert.equal(await get(`mybox.local:${port}`), 403);
+});

src/tooling/viteBuild.test.mjs

@@ -12,7 +12,10 @@ test('explicit build inputs preserve browser-only defines, plugin order and loop
     googleApiKey: 'browser-fixture',
     cesiumToken: 'ion-fixture',
   });
-  assert.equal(config.plugins[2], plugin);
+  // The Host check runs before every other plugin's middleware.
+  assert.equal(config.plugins[0].name, 'host-check');
+  assert.equal(config.plugins[0].enforce, 'pre');
+  assert.equal(config.plugins[3], plugin);
   assert.equal(config.server.host, 'localhost');
   assert.equal(config.server.port, 4173);
   assert.deepEqual(config.server.allowedHosts, ['localhost', '127.0.0.1']);
@@ -65,7 +68,7 @@ test('build helper does not discover environment values or construct local provi
       undefined,
     );
     assert.deepEqual(
-      config.plugins.slice(2).map((plugin) => plugin.name),
+      config.plugins.slice(3).map((plugin) => plugin.name),
       ['embed-framing', 'panel-build'],
     );
   } finally {
@@ -79,7 +82,7 @@ test('root config retains existing named exports and standalone provider order',
     assert.equal(compatibility[name], value, name);
   const config = standaloneConfig({ mode: 'test' });
   assert.deepEqual(
-    config.plugins.slice(2, -4).map((plugin) => plugin.name),
+    config.plugins.slice(3, -4).map((plugin) => plugin.name),
     providers.localProviderPlugins().map((plugin) => plugin.name),
   );
   assert.equal(config.plugins.at(-5).name, 'gev-key-setup');