Goal
Honor the allowedHosts array on the dev-server builder so projects running behind tunneling proxies (ngrok, Cloudflare Tunnel, GitHub Codespaces) or non-default local hostnames (*.localhost, app.local) don't get rejected by the dev server's host-header check.
Current state
allowedHosts is silently dropped. tiny_http doesn't enforce host-header checking by default, so today ngc-rs accepts any Host: header — which is permissive but doesn't give users the security knob @angular/build:dev-server exposes (and which Vite-based dev servers default to enforcing).
Scope
packages/builder/schemas/dev-server.json: add allowedHosts: { type: array, items: { type: string } }. Special values: "all" (accept any), "auto" (accept localhost + the bound host).packages/builder/src/serve/options.ts: forward as --allowed-hosts <list>.crates/cli/src/serve_cmd.rs + crates/dev-server/: filter incoming requests by Host: header, reject mismatches with 403. Default behavior matches @angular/build's — accept localhost, 127.0.0.1, [::1], auto-mode resolves from the bind address.
Definition of done
"allowedHosts": ["my-app.ngrok.io"] lets ngrok-tunneled traffic through."allowedHosts": ["all"] disables the check entirely.- A request to a non-allowed host (default: anything other than localhost) gets a 403 with a clear error body.
Refs
Angular docs: https://angular.dev/cli/serve#options ("allowedHosts")
Goal
Honor the
allowedHostsarray on the dev-server builder so projects running behind tunneling proxies (ngrok, Cloudflare Tunnel, GitHub Codespaces) or non-default local hostnames (*.localhost,app.local) don't get rejected by the dev server's host-header check.Current state
allowedHostsis silently dropped.tiny_httpdoesn't enforce host-header checking by default, so today ngc-rs accepts anyHost:header — which is permissive but doesn't give users the security knob@angular/build:dev-serverexposes (and which Vite-based dev servers default to enforcing).Scope
packages/builder/schemas/dev-server.json: addallowedHosts: { type: array, items: { type: string } }. Special values:"all"(accept any),"auto"(accept localhost + the bound host).packages/builder/src/serve/options.ts: forward as--allowed-hosts <list>.crates/cli/src/serve_cmd.rs+crates/dev-server/: filter incoming requests byHost:header, reject mismatches with 403. Default behavior matches@angular/build's — acceptlocalhost,127.0.0.1,[::1],auto-mode resolves from the bind address.Definition of done
"allowedHosts": ["my-app.ngrok.io"]lets ngrok-tunneled traffic through."allowedHosts": ["all"]disables the check entirely.Refs
Angular docs: https://angular.dev/cli/serve#options ("allowedHosts")