Commit 3c6d26a
fix(@angular-devkit/build-angular): remove unconditional CORS wildcard from webpack dev-server
The legacy webpack-based dev-server unconditionally sets
`Access-Control-Allow-Origin: *` on every response. This overrides
webpack-dev-server v5's cross-origin protections and leaves the local
dev server readable by any web page the developer visits in the same
browser session.
The modern `@angular/build` dev-server (Vite-based) already does not
set this header by default; its test contract explicitly asserts that
`Access-Control-Allow-Origin` is absent unless the user configures it.
This change brings the legacy webpack dev-server in line with that
contract.
Users who relied on the previous behavior can opt back in explicitly
via the existing `headers` option in `angular.json`:
"serve": {
"options": {
"headers": { "Access-Control-Allow-Origin": "*" }
}
}
(cherry picked from commit 4526dee)1 parent 2b3e955 commit 3c6d26a
2 files changed
Lines changed: 66 additions & 4 deletions
File tree
- packages/angular_devkit/build_angular/src
- builders/dev-server/tests/options
- tools/webpack/configs
Lines changed: 65 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -0,0 +1,65 @@ | |||
| 1 | + /** | ||
| 2 | + * @license | ||
| 3 | + * Copyright Google LLC All Rights Reserved. | ||
| 4 | + * | ||
| 5 | + * Use of this source code is governed by an MIT-style license that can be | ||
| 6 | + * found in the LICENSE file at https://angular.dev/license | ||
| 7 | + */ | ||
| 8 | + | ||
| 9 | + import { executeDevServer } from '../../index'; | ||
| 10 | + import { executeOnceAndFetch } from '../execute-fetch'; | ||
| 11 | + import { describeServeBuilder } from '../jasmine-helpers'; | ||
| 12 | + import { BASE_OPTIONS, DEV_SERVER_BUILDER_INFO } from '../setup'; | ||
| 13 | + | ||
| 14 | + describeServeBuilder(executeDevServer, DEV_SERVER_BUILDER_INFO, (harness, setupTarget) => { | ||
| 15 | + describe('option: "headers"', () => { | ||
| 16 | + beforeEach(async () => { | ||
| 17 | + setupTarget(harness, { | ||
| 18 | + styles: ['src/styles.css'], | ||
| 19 | + }); | ||
| 20 | + | ||
| 21 | + // Application code is not needed for these tests | ||
| 22 | + await harness.writeFile('src/main.ts', ''); | ||
| 23 | + await harness.writeFile('src/styles.css', ''); | ||
| 24 | + }); | ||
| 25 | + | ||
| 26 | + it('index response headers should include configured header', async () => { | ||
| 27 | + harness.useTarget('serve', { | ||
| 28 | + ...BASE_OPTIONS, | ||
| 29 | + headers: { | ||
| 30 | + 'x-custom': 'foo', | ||
| 31 | + }, | ||
| 32 | + }); | ||
| 33 | + | ||
| 34 | + const { result, response } = await executeOnceAndFetch(harness, '/'); | ||
| 35 | + | ||
| 36 | + expect(result?.success).toBeTrue(); | ||
| 37 | + expect(await response?.headers.get('x-custom')).toBe('foo'); | ||
| 38 | + }); | ||
| 39 | + | ||
| 40 | + it('should include configured Access-Control-Allow-Origin header', async () => { | ||
| 41 | + harness.useTarget('serve', { | ||
| 42 | + ...BASE_OPTIONS, | ||
| 43 | + headers: { | ||
| 44 | + 'Access-Control-Allow-Origin': 'http://example.com', | ||
| 45 | + }, | ||
| 46 | + }); | ||
| 47 | + | ||
| 48 | + const { result, response } = await executeOnceAndFetch(harness, '/main.js'); | ||
| 49 | + | ||
| 50 | + expect(result?.success).toBeTrue(); | ||
| 51 | + expect(await response?.headers.get('access-control-allow-origin')).toBe('http://example.com'); | ||
| 52 | + }); | ||
| 53 | + | ||
| 54 | + it('should not include Access-Control-Allow-Origin header by default', async () => { | ||
| 55 | + harness.useTarget('serve', { | ||
| 56 | + ...BASE_OPTIONS, | ||
| 57 | + }); | ||
| 58 | + | ||
| 59 | + const { result, response } = await executeOnceAndFetch(harness, '/main.js'); | ||
| 60 | + | ||
| 61 | + expect(result?.success).toBeTrue(); | ||
| 62 | + expect(await response?.headers.has('access-control-allow-origin')).toBeFalse(); | ||
| 63 | + }); | ||
| 64 | + }); | ||
| 65 | + }); | ||
Lines changed: 1 addition & 4 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -60,10 +60,7 @@ export async function getDevServerConfig( | |||
| 60 | 60 | devServer: { | |
| 61 | 61 | host, | |
| 62 | 62 | port, | |
| 63 | - headers: { | ||
| 64 | - 'Access-Control-Allow-Origin': '*', | ||
| 65 | - ...headers, | ||
| 66 | - }, | ||
| 63 | + headers, | ||
| 67 | 64 | historyApiFallback: !!index && { | |
| 68 | 65 | index: posix.join(servePath, getIndexOutputFile(index)), | |
| 69 | 66 | disableDotRule: true, | |
0 commit comments