mirror of
https://github.com/bilawalsidhu/gods-eye-view.git
synced 2026-11-04 10:24:02 +00:00
98b8c6c581
Binding HOST=0.0.0.0 no longer sets Vite's allowedHosts to true. The dev and preview servers accept IP addresses, localhost and the LAN hostnames listed in GEV_ALLOWED_HOSTS; suffix and wildcard entries are ignored. The configuration factory takes the resolved list as an input, so build/vite.js still reads no environment. Ported from #97 to the current build/vite.js layout. Fixes #21. Co-authored-by: Sameh Khamis <[email protected]> Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
27 lines
1.1 KiB
JavaScript
27 lines
1.1 KiB
JavaScript
/**
|
|
* Host header allowlist for the Vite dev/preview server. The configuration
|
|
* factory passes the configured names in; this module reads no environment.
|
|
*
|
|
* Binding to a wildcard interface only controls which network interfaces accept
|
|
* connections. It must not turn into a wildcard Host-header policy: this server
|
|
* brokers configured API keys through local proxy routes.
|
|
*/
|
|
export const DEFAULT_ALLOWED_HOSTS = Object.freeze(['localhost', '127.0.0.1']);
|
|
|
|
/**
|
|
* Resolve Vite's allowedHosts setting from an optional comma-separated list.
|
|
* Empty entries and suffix/wildcard entries are ignored; repeated names keep
|
|
* their first occurrence. Vite treats leading-dot values as suffix wildcards,
|
|
* which would defeat an explicit host policy.
|
|
*
|
|
* @param {string|undefined|null} configuredHosts
|
|
* @returns {string[]}
|
|
*/
|
|
export function resolveAllowedHosts(configuredHosts) {
|
|
const hosts = String(configuredHosts ?? '')
|
|
.split(',')
|
|
.map((host) => host.trim())
|
|
.filter((host) => host && !host.startsWith('.') && !host.includes('*'));
|
|
return [...new Set([...DEFAULT_ALLOWED_HOSTS, ...hosts])];
|
|
}
|