Skip to content

Commit 8f63cd6

Browse files
sapphi-redsapphi-red
committed
fix: allow CORS from loopback addresses by default (#19249)
1 parent 0bc52e0 commit 8f63cd6

File tree

5 files changed

+62
-7
lines changed

5 files changed

+62
-7
lines changed

‎docs/config/server-options.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -149,7 +149,7 @@ export default defineConfig({
149149
## server.cors
150150

151151
- **Type:** `boolean | CorsOptions`
152-
- **Default:** `false`
152+
- **Default:** `{ origin: /^https?:\/\/(?:(?:[^:]+\.)?localhost|127\.0\.0\.1|\[::1\])(?::\d+)?$/ }` (allows localhost, `127.0.0.1` and `::1`)
153153

154154
Configure CORS for the dev server. Pass an [options object](https://github.com/expressjs/cors#configuration-options) to fine tune the behavior or `true` to allow any origin.
155155

‎packages/vite/src/node/__tests__/constants.spec.ts‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
import { expect, test } from 'vitest'
2+
import { defaultAllowedOrigins } from '../constants'
3+
4+
test('defaultAllowedOrigins', () => {
5+
const allowed = [
6+
'http://localhost',
7+
'http://foo.localhost',
8+
'http://localhost:3000',
9+
'https://localhost:3000',
10+
'http://127.0.0.1',
11+
'http://[::1]',
12+
'http://[::1]:3000',
13+
]
14+
const denied = [
15+
'file:///foo',
16+
'http://localhost.example.com',
17+
'http://foo.example.com:localhost',
18+
'http://',
19+
'http://192.0.2',
20+
'http://[2001:db8::1]',
21+
'http://vite',
22+
'http://vite:3000',
23+
]
24+
25+
for (const origin of allowed) {
26+
expect(defaultAllowedOrigins.test(origin), origin).toBe(true)
27+
}
28+
29+
for (const origin of denied) {
30+
expect(defaultAllowedOrigins.test(origin), origin).toBe(false)
31+
}
32+
})

‎packages/vite/src/node/constants.ts‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -151,3 +151,10 @@ export const wildcardHosts = new Set([
151151
export const DEFAULT_DEV_PORT = 5173
152152

153153
export const DEFAULT_PREVIEW_PORT = 4173
154+
155+
// the regex to allow loopback address origins:
156+
// - localhost domains (which will always resolve to the loopback address by RFC 6761 section 6.3)
157+
// - 127.0.0.1
158+
// - ::1
159+
export const defaultAllowedOrigins =
160+
/^https?:\/\/(?:(?:[^:]+\.)?localhost|127\.0\.0\.1|\[::1\])(?::\d+)?$/

‎packages/vite/src/node/preview.ts‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ import connect from 'connect'
66
import type { Connect } from 'dep-types/connect'
77
import corsMiddleware from 'cors'
88
import type { ResolvedServerOptions, ResolvedServerUrls } from './server'
9+
import { DEFAULT_PREVIEW_PORT , defaultAllowedOrigins } from './constants'
910
import type { CommonServerOptions } from './http'
1011
import {
1112
httpServerStart,
@@ -18,7 +19,6 @@ import compression from './server/middlewares/compression'
1819
import { proxyMiddleware } from './server/middlewares/proxy'
1920
import { resolveHostname, resolveServerUrls, shouldServeFile } from './utils'
2021
import { printServerUrls } from './logger'
21-
import { DEFAULT_PREVIEW_PORT } from './constants'
2222
import { resolveConfig } from './config'
2323
import type { InlineConfig, ResolvedConfig } from './config'
2424
import { hostCheckMiddleware } from './server/middlewares/hostCheck'
@@ -146,8 +146,14 @@ export async function preview(
146146

147147
// cors
148148
const { cors } = config.preview
149-
if (cors !== undefined && cors !== false) {
150-
app.use(corsMiddleware(typeof cors === 'boolean' ? {} : cors))
149+
if (cors !== false) {
150+
app.use(
151+
corsMiddleware(
152+
typeof cors === 'boolean'
153+
? {}
154+
: cors ?? { origin: defaultAllowedOrigins },
155+
),
156+
)
151157
}
152158

153159
// host check (to prevent DNS rebinding attacks)

‎packages/vite/src/node/server/index.ts‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,11 @@ import {
4242
} from '../optimizer'
4343
import { bindShortcuts } from '../shortcuts'
4444
import type { BindShortcutsOptions } from '../shortcuts'
45-
import { CLIENT_DIR, DEFAULT_DEV_PORT } from '../constants'
45+
import {
46+
CLIENT_DIR,
47+
DEFAULT_DEV_PORT,
48+
defaultAllowedOrigins,
49+
} from '../constants'
4650
import type { Logger } from '../logger'
4751
import { printServerUrls } from '../logger'
4852
import { resolveChokidarOptions } from '../watch'
@@ -614,8 +618,14 @@ export async function _createServer(
614618

615619
// cors
616620
const { cors } = serverConfig
617-
if (cors !== undefined && cors !== false) {
618-
middlewares.use(corsMiddleware(typeof cors === 'boolean' ? {} : cors))
621+
if (cors !== false) {
622+
middlewares.use(
623+
corsMiddleware(
624+
typeof cors === 'boolean'
625+
? {}
626+
: cors ?? { origin: defaultAllowedOrigins },
627+
),
628+
)
619629
}
620630

621631
// host check (to prevent DNS rebinding attacks)

0 commit comments

Comments
 (0)