Invalid Host header after updating to 1.0.1

[SanderElias]

- [x ] bug report -> please search issues before submitting
- [ ] feature request

Versions.

1.0.1

Repro steps.

update to 1.0.1
ng serve
browser will read: Invalid Host header, and do nothing

The log given by the failure.

none

Desired functionality.

serve my application.

Mention any other details that might be useful.

Downgrading to 1.0.0 fixed the issue. (BTW, running on ubuntu and debian, same issue)

[MichalBu]

same here, runs on debian

[AlanCrevon]

same here on OSX.

[kolkov]

Maybe it related to?
webpack/webpack-dev-server#882

[amiram]

It's indeed due to a security fix added lately to webpack-dev-server. You must start with
ng serve --host your.ip.addr.ess

[SanderElias]

@amiram I had to add some trickery to my hosts file, and serve from a name, but it is indeed the curlpit.
Closing as it's not a CLI issue!

[amiram]

@SanderElias there is a new option in webpack disableHostCheck that will also solve it. Can I set it if I'm using angular cli?

[SanderElias]

@amiram Nope, it's not exported to cmd-line yet afaik. Seems even impossible from webpack cmd-line itself for now.

[flackjap]

In the details of this Webpack security update, there's an important note:

The Host header of the request have to match the listening adress or the host provided in the public option.

It means what it means. If you were using just a webpack-dev-server and localhost hostname or 127.0.0.1 to develop/test an app in your browser, you should be fine.

But if you were using it behind a hostname (e.g. myapp.com) while the NG CLI or Webpack dev server served your app from the default address, and you proxied requests to it from, let's say, Nginx, then the whole HTTP header forwarding path must be matched. I left an example in the previously linked issue - webpack/webpack-dev-server#882 (comment)

[dinvlad]

Seems like specifying --public <hostname> option for webpack-dev-server works for people behind proxies. Would it be possible to add it to ng serve?

[vivekamin]

I have multitenant system .SO in 1.0.0 version when I was adding subdomain It was working. But now It is giving me Invalid host header.
localhost(success)
asd.localhost(Invalid host header)
How to allow any subdomain?

[SanderElias]

@vivekamin edit your hosts file is the easiest. The dev server is not meant to be used in production. This a secutiry measure taken by the webpack team. There is little no nothing the CLI team can do, execpt from exposing the switched spoken about above!

[vivekamin]

@SanderElias which hosts file? Can you please elaborate. Is it nginx hosts files? How to do It in development environment ?

[dinvlad]

/etc/hosts if you're on Linux. That's inconvenient though, if the host is always migrating, like in some cloud environments.. Besides, there could be DNS complications depending on the network setup.

Adding --public seems like a better option - no hosts need to be edited, and security is uncompromised.