"Invalid Host Header" in JS console since upgrading to Webpacker 2.0

[catskull]

Since upgrading to webpacker 2.0, I'm getting a bunch of "invalid host header" errors in the JS console. Other sources online have said to pass disableHostCheck true when starting webpack-dev-server. I've modified my webpacker.yml to look like this:

development:
  <<: *default

  dev_server:
    host: 0.0.0.0
    port: 8080
    disableHostCheck: true
    https: false

And then development.js, I've modified the devServer object to include this line:
disableHostCheck: settings.dev_server.disableHostCheck,

Is that appropriate? Is anyone else getting these errors?

[irrg]

Are you hitting localhost for development, or a hostname that aliases to it? I ask because I use an alias (local.mydomain) to hit my localhost and I started getting Invalid Host Header during my testing of webpacker today.

This seems to be a change due to a decently sized security risk:

https://medium.com/webpack/webpack-dev-server-middleware-security-issues-1489d950874a

I think a patch like the above that exposes disableHostCheck would be good. I'd also expose the public value but I wasn't able to get it to actually do anything for me without also changing host.

In the meantime, if you run webpack-dev-server on a non-'localhost' domain name that hits localhost, ./bin/webpack-dev-server --host yourcustomhostmname also shuts it up, and is less of an issue without disabling the host check.

[catskull]

Interesting. In my case I'm using straight up localhost. I mean my rails app runs on pow, but I don't think that has any effect.

[irrg]

Yeah, that's kind of what I was trying to say. I'm not experienced with pow, but if you hit foo.dev for your localhost rails server, that'd fit my definition of an alias. I forget the technical term. I just add my aliases to /etc/hosts.

[catskull]

Oh, I mean rails app is aliased, but webpack-dev-server runs on localhost:8080. I thought you were saying your webpack-dev-server was aliased.

[catskull]

Update: Instead of the above fix, I changed the dev server host in webpacker.yml from 0.0.0.0 to localhost and it works fine now.

[gauravtiwari]

Fixed in #431

[jackfranklin]

I just wanted to add to this issue as I had this same problem and googled it and found this issue. For me the problem was that another webpack-dev-server from another project was running on the same port and for whatever reason this caused the "Invalid host" error to appear. Hope that might help someone else.

[maciej-gurban]

Could also be that you're trying to load your website at a host not defined in allowedHosts (if you're using this setting).

[c80609a]

Works for me, webpack.confg.js:

module.exports = {
  devServer: {
    headers:          { 'Access-Control-Allow-Origin': '*' },
    https:            false,
    disableHostCheck: true
  },
  [...rest]
}