mirror of
https://github.com/hanzoai/next.js.git
synced 2026-10-30 14:46:38 +00:00
Zack TannerandGitHub
b2b802c043
This removes the warn-only default behavior and enforces the dev-origin guard by default. Cross-origin requests to internal dev resources now block unless they match the built-in local allowlist or an explicit `allowedDevOrigins` entry. The tests are expanded to cover default blocking, configured-but-not-allowlisted hosts, missing Referer in the no-cors path, and same-site requests without an Origin, and the docs are updated to match the new behavior.
19 lines
1.0 KiB
Plaintext
19 lines
1.0 KiB
Plaintext
---
|
|
title: allowedDevOrigins
|
|
description: Use `allowedDevOrigins` to configure additional origins that can request the dev server.
|
|
---
|
|
|
|
{/* The content of this doc is shared between the app and pages router. You can use the `<PagesOnly>Content</PagesOnly>` component to add content that is specific to the Pages Router. Any shared content should not be wrapped in a component. */}
|
|
|
|
Next.js blocks cross-origin requests to dev-only assets and endpoints during development by default to prevent unauthorized access.
|
|
|
|
To configure a Next.js application to allow requests from origins other than the hostname the server was initialized with (`localhost` by default), use the `allowedDevOrigins` config option.
|
|
|
|
`allowedDevOrigins` lets you set additional origins that can request the dev server in development mode. For example, to use `local-origin.dev` instead of only `localhost`, open `next.config.js` and add the `allowedDevOrigins` config:
|
|
|
|
```js filename="next.config.js"
|
|
module.exports = {
|
|
allowedDevOrigins: ['local-origin.dev', '*.local-origin.dev'],
|
|
}
|
|
```
|