Core: Update default allowed hosts in host validation middleware#34045
Merged
Conversation
ghengeveld
added
maintenance
|
View your CI Pipeline Execution ↗ for commit 158eaa8
☁️ Nx Cloud last updated this comment at |
valentinpalkovic
approved these changes
Mar 6, 2026
10 tasks
ghengeveld
added a commit
that referenced
this pull request
Mar 6, 2026
Core: Update default allowed hosts in host validation middleware (cherry picked from commit 0bd0483)
This was referenced Mar 6, 2026
github-actions
Bot
added
the
patch:done
31 tasks
jeremyruppel
added a commit
to coder/coder
that referenced
this pull request
Apr 1, 2026
We recently upgraded storybook and vite in #23485 which bumped our `storybook` version from 10.2.10 to 10.3.3. In 10.2.16, storybookjs/storybook#34045 was merged that changes the list of default allowed hosts to an empty array. This means if you have custom DNS set up (like through the Coder desktop app) your `.coder` domain will no longer be able to reach storybook and you'll get an `Invalid host` response. This is a breaking change, but storybook didn't treat it as such. This PR adds the `core.allowedHosts` config to our storybook dev server. I'm not sure this has the same effect for build so I left the other `viteFinal` `server.allowedHosts` config, but it may be defunct
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What I did
Updated the default allowed hosts to restrict all by default.
Checklist for Contributors
Testing
The changes in this PR are covered in the following automated tests:
Manual testing
core.allowedHosts(main config)Documentation
MIGRATION.MD
Checklist for Maintainers
When this PR is ready for testing, make sure to add
ci:normal,ci:mergedorci:dailyGH label to it to run a specific set of sandboxes. The particular set of sandboxes can be found incode/lib/cli-storybook/src/sandbox-templates.tsMake sure this PR contains one of the labels below:
Available labels
bug: Internal changes that fixes incorrect behavior.maintenance: User-facing maintenance tasks.dependencies: Upgrading (sometimes downgrading) dependencies.build: Internal-facing build tooling & test updates. Will not show up in release changelog.cleanup: Minor cleanup style change. Will not show up in release changelog.documentation: Documentation only changes. Will not show up in release changelog.feature request: Introducing a new feature.BREAKING CHANGE: Changes that break compatibility in some way with current major version.other: Changes that don't fit in the above categories.🦋 Canary release
This PR does not have a canary release associated. You can request a canary release of this pull request by mentioning the
@storybookjs/coreteam here.core team members can create a canary release here or locally with
gh workflow run --repo storybookjs/storybook publish.yml --field pr=<PR_NUMBER>