fix: try parse `server.origin` URL by bluwy · Pull Request #19241 · vitejs/vite

bluwy · 2025-01-20T15:35:57Z

Description

fix #19239

This line is causing the latest version to fail: https://github.com/laravel/vite-plugin/blob/e57a940c22f90e72002380d3dad1a2c6f1921983/src/index.ts#L154

I don't think we really expect frameworks to configure the option this way, but they have an interesting usecase that indeed make it seem like we could improve the server.origin option a bit, but maybe later in the future.

patak-cat

I don't think we should keep this fix, but we can do a quick patch with it to avoid disruption in the patch. As you said, this doesn't open up a security problem and it will still work for laravel. We should review this for 6.1 or 7.0

dominikg · 2025-01-20T19:41:19Z

packages/vite/src/node/server/middlewares/hostCheck.ts

+    try {
+      const serverOriginUrl = new URL(resolvedServerOptions.origin)
+      list.push(serverOriginUrl.hostname)
+    } catch {}


should this have a debug log at least? quiet swallowing can lead to long and frustrating debug sessions

we can add one, yes, but I don't expect that this fix will stay in place

timacdonald · 2025-01-21T04:06:08Z

We really appreciate the Vite team making this consideration for the Laravel community.

We have a PR up to make our placeholder URL a well-formed URL, which should mean this check can be removed and our plugin will continue to work.

laravel/vite-plugin#317

Thank you again for supporting our community!

| datasource | package | from | to | | ---------- | ------- | ----- | ------ | | npm | vite | 6.0.7 | 6.0.11 | ## [v6.0.11](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small6011-2025-01-21-small) - fix: `preview.allowedHosts` with specific values was not respected ([#19246](vitejs/vite#19246)) ([aeb3ec8](vitejs/vite@aeb3ec8)), closes [#19246](vitejs/vite#19246) - fix: allow CORS from loopback addresses by default ([#19249](vitejs/vite#19249)) ([3d03899](vitejs/vite@3d03899)), closes [#19249](vitejs/vite#19249) ## [v6.0.10](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small6010-2025-01-20-small) - fix: try parse `server.origin` URL ([#19241](vitejs/vite#19241)) ([2495022](vitejs/vite@2495022)), closes [#19241](vitejs/vite#19241) ## [v6.0.9](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small609-2025-01-20-small) - fix!: check host header to prevent DNS rebinding attacks and introduce `server.allowedHosts` ([bd896fb](vitejs/vite@bd896fb)) - fix!: default `server.cors: false` to disallow fetching from untrusted origins ([b09572a](vitejs/vite@b09572a)) - fix: verify token for HMR WebSocket connection ([029dcd6](vitejs/vite@029dcd6)) ## [v6.0.8](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small608-2025-01-20-small) - fix: avoid SSR HMR for HTML files ([#19193](vitejs/vite#19193)) ([3bd55bc](vitejs/vite@3bd55bc)), closes [#19193](vitejs/vite#19193) - fix: build time display 7m 60s ([#19108](vitejs/vite#19108)) ([cf0d2c8](vitejs/vite@cf0d2c8)), closes [#19108](vitejs/vite#19108) - fix: don't resolve URL starting with double slash ([#19059](vitejs/vite#19059)) ([35942cd](vitejs/vite@35942cd)), closes [#19059](vitejs/vite#19059) - fix: ensure `server.close()` only called once ([#19204](vitejs/vite#19204)) ([db81c2d](vitejs/vite@db81c2d)), closes [#19204](vitejs/vite#19204) - fix: resolve.conditions in ResolvedConfig was `defaultServerConditions` ([#19174](vitejs/vite#19174)) ([ad75c56](vitejs/vite@ad75c56)), closes [#19174](vitejs/vite#19174) - fix: tree shake stringified JSON imports ([#19189](vitejs/vite#19189)) ([f2aed62](vitejs/vite@f2aed62)), closes [#19189](vitejs/vite#19189) - fix: use shared sigterm callback ([#19203](vitejs/vite#19203)) ([47039f4](vitejs/vite@47039f4)), closes [#19203](vitejs/vite#19203) - fix(deps): update all non-major dependencies ([#19098](vitejs/vite#19098)) ([8639538](vitejs/vite@8639538)), closes [#19098](vitejs/vite#19098) - fix(optimizer): use correct default install state path for yarn PnP ([#19119](vitejs/vite#19119)) ([e690d8b](vitejs/vite@e690d8b)), closes [#19119](vitejs/vite#19119) - fix(types): improve `ESBuildOptions.include / exclude` type to allow `readonly (string | RegExp)[]` ([ea53e70](vitejs/vite@ea53e70)), closes [#19146](vitejs/vite#19146) - chore(deps): update dependency pathe to v2 ([#19139](vitejs/vite#19139)) ([71506f0](vitejs/vite@71506f0)), closes [#19139](vitejs/vite#19139)

| datasource | package | from | to | | ---------- | ------- | ----- | ----- | | npm | vite | 6.0.7 | 6.1.0 | ## [v6.1.0](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#610-2025-02-05) - refactor: deprecate `vite optimize` command ([#19348](vitejs/vite#19348)) ([6e0e3c0](vitejs/vite@6e0e3c0)), closes [#19348](vitejs/vite#19348) - feat: show hosts in cert in CLI ([#19317](vitejs/vite#19317)) ([a5e306f](vitejs/vite@a5e306f)), closes [#19317](vitejs/vite#19317) - feat: support for env var for defining allowed hosts ([#19325](vitejs/vite#19325)) ([4d88f6c](vitejs/vite@4d88f6c)), closes [#19325](vitejs/vite#19325) - feat: use native runtime to import the config ([#19178](vitejs/vite#19178)) ([7c2a794](vitejs/vite@7c2a794)), closes [#19178](vitejs/vite#19178) - fix: avoid builtStart during vite optimize ([#19356](vitejs/vite#19356)) ([fdb36e0](vitejs/vite@fdb36e0)), closes [#19356](vitejs/vite#19356) - fix(build): fix stale build manifest on watch rebuild ([#19361](vitejs/vite#19361)) ([fcd5785](vitejs/vite@fcd5785)), closes [#19361](vitejs/vite#19361) ## [v6.0.11](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small6011-2025-01-21-small) - fix: `preview.allowedHosts` with specific values was not respected ([#19246](vitejs/vite#19246)) ([aeb3ec8](vitejs/vite@aeb3ec8)), closes [#19246](vitejs/vite#19246) - fix: allow CORS from loopback addresses by default ([#19249](vitejs/vite#19249)) ([3d03899](vitejs/vite@3d03899)), closes [#19249](vitejs/vite#19249) ## [v6.0.10](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small6010-2025-01-20-small) - fix: try parse `server.origin` URL ([#19241](vitejs/vite#19241)) ([2495022](vitejs/vite@2495022)), closes [#19241](vitejs/vite#19241) ## [v6.0.9](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small609-2025-01-20-small) - fix!: check host header to prevent DNS rebinding attacks and introduce `server.allowedHosts` ([bd896fb](vitejs/vite@bd896fb)) - fix!: default `server.cors: false` to disallow fetching from untrusted origins ([b09572a](vitejs/vite@b09572a)) - fix: verify token for HMR WebSocket connection ([029dcd6](vitejs/vite@029dcd6)) ## [v6.0.8](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small608-2025-01-20-small) - fix: avoid SSR HMR for HTML files ([#19193](vitejs/vite#19193)) ([3bd55bc](vitejs/vite@3bd55bc)), closes [#19193](vitejs/vite#19193) - fix: build time display 7m 60s ([#19108](vitejs/vite#19108)) ([cf0d2c8](vitejs/vite@cf0d2c8)), closes [#19108](vitejs/vite#19108) - fix: don't resolve URL starting with double slash ([#19059](vitejs/vite#19059)) ([35942cd](vitejs/vite@35942cd)), closes [#19059](vitejs/vite#19059) - fix: ensure `server.close()` only called once ([#19204](vitejs/vite#19204)) ([db81c2d](vitejs/vite@db81c2d)), closes [#19204](vitejs/vite#19204) - fix: resolve.conditions in ResolvedConfig was `defaultServerConditions` ([#19174](vitejs/vite#19174)) ([ad75c56](vitejs/vite@ad75c56)), closes [#19174](vitejs/vite#19174) - fix: tree shake stringified JSON imports ([#19189](vitejs/vite#19189)) ([f2aed62](vitejs/vite@f2aed62)), closes [#19189](vitejs/vite#19189) - fix: use shared sigterm callback ([#19203](vitejs/vite#19203)) ([47039f4](vitejs/vite@47039f4)), closes [#19203](vitejs/vite#19203) - fix(deps): update all non-major dependencies ([#19098](vitejs/vite#19098)) ([8639538](vitejs/vite@8639538)), closes [#19098](vitejs/vite#19098) - fix(optimizer): use correct default install state path for yarn PnP ([#19119](vitejs/vite#19119)) ([e690d8b](vitejs/vite@e690d8b)), closes [#19119](vitejs/vite#19119) - fix(types): improve `ESBuildOptions.include / exclude` type to allow `readonly (string | RegExp)[]` ([ea53e70](vitejs/vite@ea53e70)), closes [#19146](vitejs/vite#19146) - chore(deps): update dependency pathe to v2 ([#19139](vitejs/vite#19139)) ([71506f0](vitejs/vite@71506f0)), closes [#19139](vitejs/vite#19139)

fix: try parse server.origin URL

b03f9fd

patak-cat approved these changes Jan 20, 2025

View reviewed changes

patak-cat merged commit 2495022 into main Jan 20, 2025
15 checks passed

patak-cat deleted the server-origin-try-parse branch January 20, 2025 19:30

patak-cat mentioned this pull request Jan 20, 2025

Vite >6.0.9 has CORS issue with laravel-vite #19239

Closed

7 tasks

dominikg reviewed Jan 20, 2025

View reviewed changes

patak-cat pushed a commit that referenced this pull request Jan 20, 2025

fix: try parse server.origin URL (#19241)

5946215

patak-cat pushed a commit that referenced this pull request Jan 20, 2025

fix: try parse server.origin URL (#19241)

3680bad

meduzen mentioned this pull request Jan 20, 2025

[1.x] Fix Invalid URL issue with Vite 6.0.9 laravel/vite-plugin#317

Merged

mandrasch mentioned this pull request Feb 3, 2025

check new Vite security settings mandrasch/ddev-laravel-vite#8

Open

moonlitusun pushed a commit to moonlitusun/vite that referenced this pull request May 25, 2025

fix: try parse server.origin URL (vitejs#19241)

509b12e

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: try parse `server.origin` URL#19241

fix: try parse `server.origin` URL#19241
patak-cat merged 1 commit intomainfrom
server-origin-try-parse

bluwy commented Jan 20, 2025

Uh oh!

patak-cat left a comment

Uh oh!

Uh oh!

dominikg Jan 20, 2025

Uh oh!

patak-cat Jan 20, 2025

Uh oh!

timacdonald commented Jan 21, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

bluwy commented Jan 20, 2025

Description

Uh oh!

patak-cat left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

dominikg Jan 20, 2025

Choose a reason for hiding this comment

Uh oh!

patak-cat Jan 20, 2025

Choose a reason for hiding this comment

Uh oh!

timacdonald commented Jan 21, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants