Jun 26, 2025 · Jun 26, 2025 · Jun 26, 2025
diff --git a/site/.storybook/main.js b/site/.storybook/main.js
 }),
 );
 }
 config.server.allowedHosts = [".coder"];
 return config;
 },
 };
diff --git a/site/vite.config.mts b/site/vite.config.mts
 secure:process.env.NODE_ENV==="production",
 },
 },
 allowedHosts:true,
 allowedHosts:[".coder"],
 },
 resolve:{
 alias:{
Original file line number	Diff line number	Diff line change
Expand Up		@@ -35,6 +35,7 @@ module.exports = {
		}),
		);
		}
		config.server.allowedHosts = [".coder"];
		return config;
		},
		};
Original file line number	Diff line number	Diff line change
Expand Up		@@ -116,7 +116,7 @@ export default defineConfig({
		secure:process.env.NODE_ENV==="production",
		},
		},
		allowedHosts:true,
Copy link MemberAuthor ethanndicksonJun 26, 2025• edited Loading Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. Setting this to`true` opens developers up (as they run their dev server) toDNS rebinding attacks, as mentioned in the documentation: /** * The hostnames that Vite is allowed to respond to. * `localhost` and subdomains under `.localhost` and all IP addresses are allowed by default. * When using HTTPS, this check is skipped. * * If a string starts with `.`, it will allow that hostname without the `.` and all subdomains under the hostname. * For example, `.example.com` will allow `example.com`, `foo.example.com`, and `foo.bar.example.com`. * * If set to `true`, the server is allowed to respond to requests for any hosts. * This is not recommended as it will be vulnerable to DNS rebinding attacks. / allowedHosts?: string[] \| true; Copy link MemberAuthor ethanndickson*Jun 26, 2025 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. If there's any other domains you'd like to add, let me know.
		allowedHosts:[".coder"],
		},
		resolve:{
		alias:{
Expand Down