[vite 6.0.9] option server.allowedHosts doesn't take into account "true"

[Reaster0]

Describe the bug

hi, i've recently updated vite to 6.0.9, the main change being the allowedHosts server conf field,

it's said in the documentation that if set to true, it will accept any hosts, but even when setting it to true i get the error:

Blocked request. This host ("hidden") is not allowed.
To allow this host, add "hidden" to server.allowedHosts in vite.config.js.

(maybe i could be dumb but it really doesn't seem to work)

Reproduction

google.com

Steps to reproduce

No response

System Info

System:
    OS: Linux 6.8 Ubuntu 24.04.1 LTS 24.04.1 LTS (Noble Numbat)
    CPU: (8) x64 11th Gen Intel(R) Core(TM) i7-1165G7 @ 2.80GHz
    Memory: 4.68 GB / 15.34 GB
    Container: Yes
    Shell: 5.9 - /usr/bin/zsh
  Binaries:
    Node: 18.19.1 - /usr/bin/node
    npm: 9.2.0 - /usr/bin/npm
  Browsers:
    Chrome: 132.0.6834.83
  npmPackages:
    @vitejs/plugin-react: ^4.2.0 => 4.2.1 
    vite: 6.0.9 => 6.0.9

Used Package Manager

npm

Logs

No response

Validations

• Follow our Code of Conduct
• Read the Contributing Guidelines.
• Read the docs.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Make sure this is a Vite issue and not a framework-specific issue. For example, if it's a Vue SFC related bug, it should likely be reported to vuejs/core instead.
• Check that this is a concrete bug. For Q&A open a GitHub Discussion or join our Discord Chat Server.
• The provided reproduction is a minimal reproducible example of the bug.

[sunilranaLivspace]

Yes, same issue coming to me as well when I am trying below config in my vite config file (vite.config.ts). Please fix it.

import { defineConfig } from 'vite';
import react from '@vitejs/plugin-react';

export default defineConfig({
	plugins: [react()],
	build: {
		outDir: 'dist',
		target: 'esnext',
	},
	preview: {
		port: 3000,
		strictPort: true,
		host: '0.0.0.0', 
		allowedHosts: true,
	},
	server: {
		allowedHosts: true
	},
});

[keyurmeandev]

https://vite.dev/config/server-options#server-allowedhosts

Tried to follow the same procedure but not working..

Blocked request. This host ("hostname") is not allowed.
To allow this host, add "hostname" to server.allowedHosts in vite.config.js.

[sapphi-red]

I wasn't able to reproduce it with a simple setup. I need a reproduction to investigate this one.

[github-actions]

Hello @Reaster0. Please provide a minimal reproduction using a GitHub repository or StackBlitz. Issues marked with needs reproduction will be closed if they have no activity within 3 days.

[gregorvand]

Also encountering this after pushing an update today, no changes to vite config
Running on GCP / Cloud Run

[gregorvand]

I resolved this by updating vite.config - what's odd here is that I had not upgraded to 6+ and the error just presented overnight.
Also the type definitions are not happy with this addition, but it works:

export default defineConfig({
	plugins: [sveltekit()],
	server: {
		cors: {
			origin: ['https://mysubdomain.domain.io', 'http://localhost:5173'],
			methods: ['GET', 'POST'],
			allowedHeaders: ['Content-Type']
		},
		allowedHosts: ['mysubdomain.domain.io'] //added this
	}
});

[rodrigocfd]

The problem still exists in 6.0.11.

Downgrading to 6.0.8 makes it work.

[OxCom]

Hm... please take a look into tools that use vite to run. For example I have same issue with vite + storybook, because of storybook. I defined in storybook config the server options:

import {mergeConfig} from 'vite';

// ...

async viteFinal(config) {
        return mergeConfig(config, {
            server: {
                hmr: {
                    path: '/ws'
                }
            }
        });
    },

and the problem is that mergeConfig will replace server options from vite

[rodrigocfd]

Hm... please take a look into tools that use vite to run.

Mine is just a plain Vite project with React. Nothing else.

[Reaster0]

i'm not sure i have the time rn to make a replication for something this simple,
if someone want to provide one

in the mean time i've rollbacked to 6.0.8

it's really a breaking issue for a lot of people,

changing the default allowedHost from 0.0.0.0 to localhost and having a bug on the same field to set back to 0.0.0.0 will break a lot of vite installations,
i'll stick on 6.0.8 until it's fixed,
thanks for your hard work nonetheless, vite is great

[Reaster0]

I resolved this by updating vite.config - what's odd here is that I had not upgraded to 6+ and the error just presented overnight. Also the type definitions are not happy with this addition, but it works:

export default defineConfig({
plugins: [sveltekit()],
server: {
cors: {
origin: ['https://mysubdomain.domain.io', 'http://localhost:5173'],
methods: ['GET', 'POST'],
allowedHeaders: ['Content-Type']
},
allowedHosts: ['mysubdomain.domain.io'] //added this
}
});

yes you can set the hosts you want in allowedHosts, the bug we encounter specifically is when setting allowedHosts to "true"

[sapphi-red]

I've tried it again but still cannot reproduce. I need a reproduction.

[gregorvand]

yes you can set the hosts you want in allowedHosts, the bug we encounter specifically is when setting allowedHosts to "true"

Understood, I also tried allowedHosts: true and it was breaking under that.

I am now using 6.0.10 so can only speak to that version.

[arifszn]

Also happening for latest 4.x.x version. Downgrading to v4.4.5 fixed it.

[sapphi-red]

Caution

Please note that downgrading will make you vulnerable to attacks described in GHSA-vg6x-rcgg-rjx6.