|
| 1 | +/** |
| 2 | + * @license |
| 3 | + * Copyright Google LLC All Rights Reserved. |
| 4 | + * |
| 5 | + * Use of this source code is governed by an MIT-style license that can be |
| 6 | + * found in the LICENSE file at https://angular.dev/license |
| 7 | + */ |
| 8 | + |
| 9 | +import type { ServerResponse } from 'node:http'; |
| 10 | +import type { Connect, ViteDevServer } from 'vite'; |
| 11 | + |
| 12 | +function extractHostname(hostHeader: string | undefined): string | undefined { |
| 13 | + if (!hostHeader) { |
| 14 | + return undefined; |
| 15 | + } |
| 16 | + |
| 17 | + // Remove port if present (e.g., example.com:4200) |
| 18 | + const idx = hostHeader.lastIndexOf(':'); |
| 19 | + if (idx > -1 && hostHeader.indexOf(']') === -1) { |
| 20 | + // Skip IPv6 addresses that include ':' within brackets |
| 21 | + return hostHeader.slice(0, idx).toLowerCase(); |
| 22 | + } |
| 23 | + |
| 24 | + return hostHeader.toLowerCase(); |
| 25 | +} |
| 26 | + |
| 27 | +function isLocalHost(name: string | undefined): boolean { |
| 28 | + if (!name) return false; |
| 29 | + return name === 'localhost' || name === '127.0.0.1' || name === '[::1]' || name === '::1'; |
| 30 | +} |
| 31 | + |
| 32 | +function html403(hostname: string): string { |
| 33 | + return `<!doctype html> |
| 34 | +<html> |
| 35 | + <head> |
| 36 | + <meta charset="utf-8" /> |
| 37 | + <meta name="viewport" content="width=device-width, initial-scale=1" /> |
| 38 | + <title>Blocked request</title> |
| 39 | + <style> |
| 40 | + body{font-family:system-ui,-apple-system,Segoe UI,Roboto,Ubuntu,Cantarell,Noto Sans,sans-serif;line-height:1.4;margin:2rem;color:#1f2937} |
| 41 | + code{background:#f3f4f6;padding:.15rem .35rem;border-radius:.25rem} |
| 42 | + .box{max-width:760px;margin:0 auto} |
| 43 | + h1{font-size:1.5rem;margin-bottom:.75rem} |
| 44 | + p{margin:.5rem 0} |
| 45 | + .muted{color:#6b7280} |
| 46 | + pre{background:#f9fafb;border:1px solid #e5e7eb;padding:.75rem;border-radius:.5rem;overflow:auto} |
| 47 | + </style> |
| 48 | + </head> |
| 49 | + <body> |
| 50 | + <div class="box"> |
| 51 | + <h1>Blocked request. This host ("${hostname}") is not allowed.</h1> |
| 52 | + <p>The Angular development server only responds to local hosts by default.</p> |
| 53 | + <p>To allow this host, add it to <code>allowedHosts</code> under the <code>serve</code> target in <code>angular.json</code>.</p> |
| 54 | + <pre><code>{ |
| 55 | + "serve": { |
| 56 | + "options": { |
| 57 | + "allowedHosts": ["${hostname}"] |
| 58 | + } |
| 59 | + } |
| 60 | +}</code></pre> |
| 61 | + </div> |
| 62 | + </body> |
| 63 | + </html>`; |
| 64 | +} |
| 65 | + |
| 66 | +/** |
| 67 | + * Middleware that enforces host checking using Angular CLI's `allowedHosts` option. |
| 68 | + * |
| 69 | + * Vite's own host check is disabled in the server configuration so that we can |
| 70 | + * present an Angular-specific guidance page when blocked. |
| 71 | + */ |
| 72 | +export function createAngularHostCheckMiddleware( |
| 73 | + _server: ViteDevServer, |
| 74 | + allowedHosts: true | string[] | undefined, |
| 75 | + devHost: string, |
| 76 | +): Connect.NextHandleFunction { |
| 77 | + // Normalize configured allowed hosts |
| 78 | + const allowAll = allowedHosts === true; |
| 79 | + const allowedSet = new Set( |
| 80 | + Array.isArray(allowedHosts) ? allowedHosts.map((h) => h.toLowerCase()) : [], |
| 81 | + ); |
| 82 | + |
| 83 | + const devHostLower = devHost?.toLowerCase?.(); |
| 84 | + |
| 85 | + return function angularHostCheckMiddleware( |
| 86 | + req: Connect.IncomingMessage, |
| 87 | + res: ServerResponse, |
| 88 | + next: Connect.NextFunction, |
| 89 | + ) { |
| 90 | + if (allowAll) { |
| 91 | + return next(); |
| 92 | + } |
| 93 | + |
| 94 | + const hostname = extractHostname(req.headers.host); |
| 95 | + |
| 96 | + // Always allow local access and the explicit dev host when meaningful |
| 97 | + if ( |
| 98 | + isLocalHost(hostname) || |
| 99 | + (devHostLower && devHostLower !== '0.0.0.0' && hostname === devHostLower) |
| 100 | + ) { |
| 101 | + return next(); |
| 102 | + } |
| 103 | + |
| 104 | + // Allow if present in configured list |
| 105 | + if (hostname && allowedSet.has(hostname)) { |
| 106 | + return next(); |
| 107 | + } |
| 108 | + |
| 109 | + // Block with an Angular-specific 403 page |
| 110 | + const body = html403(hostname ?? ''); |
| 111 | + res.statusCode = 403; |
| 112 | + res.setHeader('Content-Type', 'text/html; charset=utf-8'); |
| 113 | + res.setHeader('Content-Length', Buffer.byteLength(body)); |
| 114 | + res.end(body); |
| 115 | + }; |
| 116 | +} |
0 commit comments