[hamedniroomand]

🔗 Linked issue

resolves #1620

📚 Description

The Host check on the CLI's own endpoints (/__nuxt_dev__/*, the loading page and the load-failure page) only knew the --host value and the listener URLs. A project that sets vite.server.allowedHosts still got a 403 from these endpoints, so the error overlay failed without a message on a hosts-file alias.

Now the check also reads vite.server.allowedHosts from the loaded nuxt.config:

• An array adds each entry. An entry with a leading dot works as in Vite: .example.com allows example.com and all its subdomains.
• true turns off only the Host check on these endpoints. It does not change CORS or anything else that --public does.
• A config reload builds the allowlist again, so a removed entry gets a 403 again. If the reload fails, the entries of the last loaded config stay.
• The hostnames that the CLI itself adds to vite.server.allowedHosts are not read back as project entries.
• The 403 message now also names vite.server.allowedHosts in nuxt.config.

Before the config loads (the first loading screen), the check is the same as before.

Known limit: when a project entry is the same as a hostname that the CLI added for the listener of the previous run, that entry gets a 403 on the first load. It works after the next reload. This fails toward the safe side (a 403), never toward an extra allow.

The analysis and the direction come from @Togetic in #1620.

[pkg-pr-new]

• nuxt-cli-playground

  npm i https://pkg.pr.new/create-nuxt@1636
  

  npm i https://pkg.pr.new/nuxi@1636
  

  npm i https://pkg.pr.new/@nuxt/cli@1636
  

commit: e3beac5

[github-actions]

CLI benchmark

@nuxt/cli v4.0.1 (baseline) vs v4.0.1 (this PR)

Metric	baseline v4.0.1	head v4.0.1	Delta
nuxt --version wall time (median)	65 ms	65 ms	-0.2%
nuxt --help wall time (median)	136 ms	137 ms	+0.8%
nuxt dev --help wall time (median)	102 ms	102 ms	-0.3%
nuxt --version modules loaded	35	35	0.0%
nuxt --version built-ins loaded	29	29	0.0%
nuxt --help modules loaded	135	135	0.0%
nuxt --help built-ins loaded	90	90	0.0%
nuxt dev --help modules loaded	64	64	0.0%
nuxt dev --help built-ins loaded	90	90	0.0%
Installed node_modules	2.47 MB	2.47 MB	+0.1%
Published tarball (packed)	242.3 kB	242.8 kB	+0.2%

Full report

@nuxt/cli v4.0.1 (baseline) vs v4.0.1 (head)

Setting	Value
Baseline	ref:93315b9d1f20f71870d80b095017813789894466 (v4.0.1)
Head	local packages/nuxt-cli at baba73c (v4.0.1)
Node	v24.22.1
OS	Linux 6.17.0 (kernel 6.17.0-1022-azure)
CPU	AMD EPYC 7763 64-Core Processor x 4
Memory	15.6 GB
Load average at start	1.16, 0.33, 0.11
Run started	2026-10-26T18:35:51.268Z

Cold CLI startup

Median of 15 interleaved runs per command, one warmup discarded.

Command	baseline v4.0.1 median	head v4.0.1 median	Delta	baseline v4.0.1 min / p95	head v4.0.1 min / p95
nuxt --version	65 ms	65 ms	-0.2%	61 ms / 67 ms	61 ms / 68 ms
nuxt --version (first output byte)	61 ms	61 ms	-0.2%	58 ms / 63 ms	58 ms / 64 ms
nuxt --help	136 ms	137 ms	+0.8%	133 ms / 139 ms	132 ms / 140 ms
nuxt --help (first output byte)	132 ms	132 ms	+0.4%	128 ms / 134 ms	127 ms / 135 ms
nuxt dev --help	102 ms	102 ms	-0.3%	98 ms / 106 ms	100 ms / 103 ms
nuxt dev --help (first output byte)	98 ms	97 ms	-0.6%	94 ms / 102 ms	95 ms / 99 ms
nuxt <unknown-command> (no-op)	145 ms	147 ms	+0.8%	142 ms / 149 ms	143 ms / 150 ms
nuxt <unknown-command> (no-op) (first output byte)	140 ms	141 ms	+0.8%	137 ms / 143 ms	138 ms / 145 ms

Module load cost

Counted with a module.registerHooks load hook, compile cache disabled. Counts every JS module actually evaluated on that code path (native addons excluded). Built-ins loaded after bootstrap are counted separately, including the internal modules they load.

Command	baseline v4.0.1 modules	head v4.0.1 modules	Delta	baseline v4.0.1 source bytes	head v4.0.1 source bytes	Delta	baseline v4.0.1 built-ins	head v4.0.1 built-ins	Delta
nuxt --version	35	35	0.0%	298.0 kB	298.0 kB	0.0%	29	29	0.0%
nuxt --help	135	135	0.0%	852.4 kB	853.2 kB	+0.1%	90	90	0.0%
nuxt dev --help	64	64	0.0%	458.1 kB	458.1 kB	0.0%	90	90	0.0%

Install footprint and published tarball

Each version installed on its own into an empty project with nothing but @nuxt/cli as a dependency, so the tree is exactly the CLI and its transitive dependencies. npm cache is warm and the registry is only consulted for metadata, so install wall time is indicative, not a network benchmark.

Metric	baseline v4.0.1	head v4.0.1	Delta
Direct dependencies of @nuxt/cli	23	23	0.0%
Packages in the installed tree (unique name@version)	39	39	0.0%
Unique package names	39	39	0.0%
Package directories on disk (cross-check)	32	32	0.0%
Installed node_modules on disk	2.47 MB	2.47 MB	+0.1%
Installed files	436	436	0.0%
Install wall time (warm npm cache, median of 3)	1.25 s	1.25 s	+0.4%
Published tarball (packed)	242.3 kB	242.8 kB	+0.2%
Published tarball (unpacked)	786.7 kB	788.5 kB	+0.2%
Files in tarball	101	101	0.0%

Interleaved runs on a shared runner: trust the deltas, not the absolute timings. The dev, restart and build suites run locally via pnpm bench:cli.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6ece1c1f-c780-488c-a9a5-47a270cf8d20

Commits

Reviewing files that changed from the base of the PR and between dedb192 and e3beac5.

Files selected for processing: 7

• packages/nuxt-cli/src/commands/analyze.ts
• packages/nuxt-cli/src/dev/error-channel.ts
• packages/nuxt-cli/src/dev/host-check.ts
• packages/nuxt-cli/src/dev/utils.ts
• packages/nuxt-cli/src/utils/dev-hint.ts
• packages/nuxt-cli/test/unit/commands/analyze.spec.ts
• packages/nuxt-cli/test/unit/dev/lifecycle.spec.ts

Files skipped from review as they are similar to previous changes: 1

• packages/nuxt-cli/src/dev/error-channel.ts

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 0 remain after this review.

Walkthrough

The dev server Host check now uses vite.server.allowedHosts alongside listener-derived hosts. Exact entries and leading-dot domain entries are checked, and allowedHosts: true permits any host. The server updates the allowlist after configuration loads and reloads. Unit and end-to-end tests cover host matching, endpoint responses, configuration changes, and failed reloads.

Priority: Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Severity of issue fixed: Medium

Merge Risk: Minimal · up to e3bea

The change makes the CLI's Host check honor vite.server.allowedHosts, with default behavior unchanged before config loads. No actionable merge-blocking risk remains.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 43.75% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 16 functions across 9 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title names the two areas changed (analyze and dev commands) and the main behaviour change, which is that host checks now respect vite.server.allowedHosts. It is specific and matches the changeset…
Description check		The description is closely related to the changeset. It explains that the Host check on the CLI's own endpoints now reads vite.server.allowedHosts, describes the leading-dot domain behaviour, the effe…
Linked Issues check		Issue [#1620] requires the CLI Host check to honour vite.server.allowedHosts while preserving the security default. NuxtDevServer.#syncAllowedHosts reads the loaded configuration, accepts string a…
Out of Scope Changes check		The changes stay within the host-allowlist objective in [#1620]. They update the shared host-check logic, the CLI development and analyse servers, saved configuration hints, refusal guidance, and rela…

Full details: Title check

Explanation

The title names the two areas changed (analyze and dev commands) and the main behaviour change, which is that host checks now respect vite.server.allowedHosts. It is specific and matches the changeset, which adds allowedHosts handling to the dev server host checks and the analyze server host checks.

Full details: Description check

Explanation

The description is closely related to the changeset. It explains that the Host check on the CLI's own endpoints now reads vite.server.allowedHosts, describes the leading-dot domain behaviour, the effect of true, config reload handling, the 403 message change, and a known first-load limit. It matches the summaries for host-check.ts, utils.ts, and the related tests.

Full details: Linked Issues check

Explanation

Issue [#1620] requires the CLI Host check to honour vite.server.allowedHosts while preserving the security default. NuxtDevServer.#syncAllowedHosts reads the loaded configuration, accepts string arrays, and treats true as a Host-check opt-out only. isAllowedHost implements Vite leading-dot domain and subdomain matching. Reloads rebuild the allowlist, failed reloads retain the last loaded values, and tests cover these cases plus unchanged CORS behaviour. The optional environment variable, flag, and overlay warning proposals are not required objectives.

Full details: Out of Scope Changes check

Explanation

The changes stay within the host-allowlist objective in [#1620]. They update the shared host-check logic, the CLI development and analyse servers, saved configuration hints, refusal guidance, and related tests. The analyse-server change reuses the same policy and has focused host-check tests. No unrelated runtime behaviour is demonstrated.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codspeed]

Merging this PR will not alter performance

1 warning

⚠️ 2 benchmarks are dominated by system calls

System calls cannot be simulated consistently and are left out of the measure. The reported value understates the real cost. Switch to the Walltime instrument to measure them.

Learn more about system calls

See affected benchmarks

✅ 2 untouched benchmarks

---

_{Comparing hamedniroomand:fix/dev-allowed-hosts (e3beac5) with main (93315b9)}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@93315b9). Learn more about missing BASE report.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1636   +/-   ##
=======================================
  Coverage        ?   84.31%           
=======================================
  Files           ?      181           
  Lines           ?    11655           
  Branches        ?     3339           
=======================================
  Hits            ?     9827           
  Misses          ?     1540           
  Partials        ?      288           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[danielroe]

thank you!