fix(dev): do not infer public mode from a non-loopback host

Author: danielroe

docs/dev.md

@@ -53,7 +53,7 @@ The `dev` command starts a development server with hot module replacement at [ht
 | `--clipboard`                        | `false`           | Copy the URL to the clipboard                                                                                                                        |
 | `--qr`                               |                   | Print a QR code for the public URL (enabled by default when one is available)                                                                        |
 | `--tunnel`                           |                   | Expose the server via a Cloudflare quick tunnel                                                                                                      |
-| `--public`                           |                   | Listen on all network interfaces                                                                                                                     |
+| `--public`                           |                   | Listen on all network interfaces and allow any host to connect                                                                                       |
 | `--publicURL=<url>`                  |                   | Public URL to display (used for QR code and clipboard)                                                                                               |
 | `--https`                            |                   | Enable HTTPS with a locally-trusted development certificate                                                                                          |
 | `--https.cert=<path>`                |                   | Path to TLS certificate                                                                                                                              |

packages/nuxt-cli/src/commands/dev.ts

@@ -120,7 +120,7 @@ const command = defineCommand({
     },
     'public': {
       type: 'boolean',
-      description: 'Listen on all network interfaces',
+      description: 'Listen on all network interfaces and allow any host to connect',
     },
     'publicURL': {
       type: 'string',

packages/nuxt-cli/src/dev/utils.ts

@@ -496,7 +496,7 @@ export class NuxtDevServer extends EventEmitter<DevServerEventMap> {
       res.statusCode = 403
       res.setHeader('Content-Type', 'text/plain')
     }
-    res.end('Forbidden: this host is not allowed. Pass `--host` to allow it.')
+    res.end('Forbidden: this host is not allowed. Pass it to `--host`, or `--public` to allow any host.')
     return true
   }
 
@@ -1039,7 +1039,10 @@ export class NuxtDevServer extends EventEmitter<DevServerEventMap> {
 
     const hostname = overrides.hostname ?? nuxtConfig.devServer?.host
 
-    const isPublic = provider === 'codesandbox' || (overrides.public ?? (isPublicHostname(hostname) ? true : undefined))
+    // Only `--public` (or a sandbox that fronts the server) drops the `Host` and
+    // CORS checks. A non-loopback `--host` widens who can reach the bind, not
+    // which origins may read from it.
+    const isPublic = provider === 'codesandbox' || overrides.public
 
     // `--https` (or its absence) wins over the config; `https.*` arguments and
     // `devServer.https` options only apply once https is enabled.
@@ -1529,7 +1532,3 @@ function createConfigDirWatcher(cwd: string, onReload: (path: string) => void) {
     configDirWatcher.close()
   }
 }
-
-function isPublicHostname(hostname: string | undefined): boolean {
-  return !!hostname && !['localhost', '127.0.0.1', '::1'].includes(hostname)
-}

packages/nuxt-cli/test/e2e/dev-allowed-hosts.spec.ts

@@ -26,6 +26,13 @@ describe('dev server allowed hosts', () => {
     expect(allowedHosts).toEqual(['127.0.0.1'])
   })
 
+  it('should keep the host allowlist for a non-loopback `--host`', { timeout: 120_000 }, async () => {
+    const allowedHosts = await resolveAllowedHosts(['--host=0.0.0.0'])
+
+    expect(allowedHosts).not.toBe(true)
+    expect(allowedHosts).toContain('localhost')
+  })
+
   it('should allow any host when the server is public', { timeout: 120_000 }, async () => {
     const allowedHosts = await resolveAllowedHosts(['--public'])