Skip to content

fix(@angular/ssr): improve header validation logic#32622

Open
alan-agius4 wants to merge 1 commit intoangular:21.2.xfrom
alan-agius4:handle-validation-patch
Open

fix(@angular/ssr): improve header validation logic#32622
alan-agius4 wants to merge 1 commit intoangular:21.2.xfrom
alan-agius4:handle-validation-patch

Conversation

@alan-agius4
Copy link
Collaborator

Updates the validateRequest function to correctly handle the allowedHost=true option.

@alan-agius4 alan-agius4 requested a review from dgp1130 February 27, 2026 09:06
@alan-agius4 alan-agius4 added action: review The PR is still awaiting reviews from at least one requested reviewer target: patch This PR is targeted for the next patch release labels Feb 27, 2026
Updates the `validateRequest` function to correctly handle the `allowedHost=true` option.
@alan-agius4 alan-agius4 force-pushed the handle-validation-patch branch from 53f59db to d78ace4 Compare February 27, 2026 09:59
Copy link
Collaborator

@dgp1130 dgp1130 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Question: Is allowedHosts: true distinct from allowedHosts: ['*'], which could also be set via environment variable? Is there a reason to prefer this instead?


// Disable host check if allowed hosts is true meaning allow all hosts.
const { allowedHosts } = server.config.server;
const disableAllowedHostsCheck = allowedHosts === true;
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consider framing this in the positive like:

const checkAllowedHosts = Array.isArray(allowedHosts);

As positive conditionals can often be easier to reason about.

@alan-agius4
Copy link
Collaborator Author

alan-agius4 commented Feb 27, 2026

‘allowedHosts: ['*']’ is not supported, and ‘allowedHost=true` is already an option supported by Vite.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

action: review The PR is still awaiting reviews from at least one requested reviewer area: @angular/ssr target: patch This PR is targeted for the next patch release

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants