[PR #337] [MERGED] Support allowedDevOrigins separately from serverActions.allowedOrigins #489

New issue

Closed

opened 2026-05-06 13:08:21 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 13:08:21 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/cloudflare/vinext/pull/337
Author: @JaredStowell
Created: 3/8/2026
Status: ✅ Merged
Merged: 3/8/2026
Merged by: @james-elicx

Base: main ← Head: jstowell/fix-allowedDevOrigins

📝 Commits (2)

632cdcf Fix and fully implement allowedDevOrigins
f3a5fbb Merge branch 'main' into jstowell/fix-allowedDevOrigins

📊 Changes

8 files changed (+189 additions, -6 deletions)

View changed files

📝 packages/vinext/src/check.ts (+2 -1)
📝 packages/vinext/src/config/next-config.ts (+10 -0)
📝 packages/vinext/src/index.ts (+3 -3)
📝 packages/vinext/src/server/app-dev-server.ts (+1 -1)
📝 tests/app-router.test.ts (+65 -1)
📝 tests/check.test.ts (+12 -0)
📝 tests/pages-router.test.ts (+54 -0)
📝 tests/shims.test.ts (+42 -0)

📄 Description

Summary

Parse and wire allowedDevOrigins as its own config surface instead of reusing experimental.serverActions.allowedOrigins.

This fixes the dev-origin enforcement so the dev server allowlist does not widen or narrow trust boundaries based on server action CSRF config.

Changes

add allowedDevOrigins to NextConfig and ResolvedNextConfig
parse top-level allowedDevOrigins in resolveNextConfig()
use allowedDevOrigins for Pages Router dev-origin checks
pass allowedDevOrigins into the App Router virtual RSC entry
keep App Router server action CSRF checks wired to experimental.serverActions.allowedOrigins
update vinext check to report allowedDevOrigins as supported

Tests

add parser tests for allowedDevOrigins defaults and separation from serverActions.allowedOrigins
add Pages Router dev-server integration coverage test/development/basic/allowed-dev-origins.test.ts
add App Router codegen/plugin wiring tests to verify allowedDevOrigins and allowedOrigins remain distinct
add vinext check coverage for allowedDevOrigins

Verification

pnpm test tests/check.test.ts -t "allowedDevOrigins|experimental.serverActions|next.config"
pnpm test tests/shims.test.ts -t "allowedDevOrigins|serverActionsAllowedOrigins"
pnpm test tests/app-router.test.ts -t "loads allowedDevOrigins from next.config into the virtual RSC entry|keeps allowedDevOrigins separate from allowedOrigins|embeds allowedDevOrigins"
pnpm test tests/pages-router.test.ts -t "Pages Router allowedDevOrigins config"
pnpm test tests/dev-origin-check.test.ts

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/cloudflare/vinext/pull/337 **Author:** [@JaredStowell](https://github.com/JaredStowell) **Created:** 3/8/2026 **Status:** ✅ Merged **Merged:** 3/8/2026 **Merged by:** [@james-elicx](https://github.com/james-elicx) **Base:** `main` ← **Head:** `jstowell/fix-allowedDevOrigins` --- ### 📝 Commits (2) - [`632cdcf`](https://github.com/cloudflare/vinext/commit/632cdcf8f0a4b8b08ced618313bff2a0f593c9cb) Fix and fully implement allowedDevOrigins - [`f3a5fbb`](https://github.com/cloudflare/vinext/commit/f3a5fbb4b5bd1265d45b19e627dfaf03a2bc37a8) Merge branch 'main' into jstowell/fix-allowedDevOrigins ### 📊 Changes **8 files changed** (+189 additions, -6 deletions) <details> <summary>View changed files</summary> 📝 `packages/vinext/src/check.ts` (+2 -1) 📝 `packages/vinext/src/config/next-config.ts` (+10 -0) 📝 `packages/vinext/src/index.ts` (+3 -3) 📝 `packages/vinext/src/server/app-dev-server.ts` (+1 -1) 📝 `tests/app-router.test.ts` (+65 -1) 📝 `tests/check.test.ts` (+12 -0) 📝 `tests/pages-router.test.ts` (+54 -0) 📝 `tests/shims.test.ts` (+42 -0) </details> ### 📄 Description ## Summary Parse and wire `allowedDevOrigins` as its own config surface instead of reusing `experimental.serverActions.allowedOrigins`. This fixes the dev-origin enforcement so the dev server allowlist does not widen or narrow trust boundaries based on server action CSRF config. ## Changes - add `allowedDevOrigins` to `NextConfig` and `ResolvedNextConfig` - parse top-level `allowedDevOrigins` in `resolveNextConfig()` - use `allowedDevOrigins` for Pages Router dev-origin checks - pass `allowedDevOrigins` into the App Router virtual RSC entry - keep App Router server action CSRF checks wired to `experimental.serverActions.allowedOrigins` - update `vinext check` to report `allowedDevOrigins` as supported ## Tests - add parser tests for `allowedDevOrigins` defaults and separation from `serverActions.allowedOrigins` - add Pages Router dev-server integration coverage `test/development/basic/allowed-dev-origins.test.ts` - add App Router codegen/plugin wiring tests to verify `allowedDevOrigins` and `allowedOrigins` remain distinct - add `vinext check` coverage for `allowedDevOrigins` ## Verification - `pnpm test tests/check.test.ts -t "allowedDevOrigins|experimental.serverActions|next.config"` - `pnpm test tests/shims.test.ts -t "allowedDevOrigins|serverActionsAllowedOrigins"` - `pnpm test tests/app-router.test.ts -t "loads allowedDevOrigins from next.config into the virtual RSC entry|keeps allowedDevOrigins separate from allowedOrigins|embeds allowedDevOrigins"` - `pnpm test tests/pages-router.test.ts -t "Pages Router allowedDevOrigins config"` - `pnpm test tests/dev-origin-check.test.ts` --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>