Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(@angular/cli): add host check flags to ng serve #6173

Merged
merged 1 commit into from
May 9, 2017

Conversation

filipesilva
Copy link
Contributor

@filipesilva filipesilva commented May 3, 2017

Two new flags are added to ng serve:

  • --public-host (aliased by --live-reload-client): Specify the URL that the browser client will use.
  • --disable-host-check: Don't verify connected clients are part of allowed hosts.

Setting --disable-host-check will output a warning:

WARNING Running a server with --disable-host-check is a security risk. See https://medium.com/webpack/webpack-dev-server-middleware-security-issues-1489d950874a for more information.

See #6070 for more context about this change.

Fix #6070

@filipesilva
Copy link
Contributor Author

/cc @SanderElias @clydin

@@ -20,7 +20,8 @@ export interface ServeTaskOptions extends BuildOptions {
host?: string;
proxyConfig?: string;
liveReload?: boolean;
liveReloadClient?: string;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Isn't removing that a breaking change?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's still there, as an alias for --public-host. So nothing changes for users of that flag.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@filipesilva I would like to rename --public-host to --public-ident. It's confusing to have 2 host options, and In my opinion, an identifier is more close to what the thing actually does. Hope this is not too late for that ;)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The option is setting the publicly accessible address of the host and is checked against the host header of all incoming requests. It's also the name used within webpack-dev-server.

@filipesilva filipesilva force-pushed the add-allowed-hosts branch 2 times, most recently from c1232a4 to 03002ef Compare May 4, 2017 20:00
sumitarora
sumitarora previously approved these changes May 5, 2017
<p>
<code>--live-reload-client</code>
<code>--public</code> (aliases: <code>--live-reload-client</code>)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

--public-host?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed

.then(() => ngServe('--host=0.0.0.0', `--public-host=${publicHost}`))
.then(() => request(localAddress))
.then(body => {
if (!body.match(/<app-root>Loading...<\/app-root>/)) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Loading will not be there anymore.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed

Two new flags are added to `ng serve`:
- `--public-host` (aliased by `--live-reload-client): Specify the URL that the browser client will use.
- `--disable-host-check`: Don't verify connected clients are part of allowed hosts.

Setting `--disable-host-check` will output a warning:
```
WARNING Running a server with --disable-host-check is a security risk. See https://medium.com/webpack/webpack-dev-server-middleware-security-issues-1489d950874a for more information.
```

See angular#6070 for more context about this change.

Fix angular#6070
@filipesilva filipesilva merged commit a54a991 into angular:master May 9, 2017
@filipesilva filipesilva deleted the add-allowed-hosts branch May 9, 2017 20:05
filipesilva pushed a commit that referenced this pull request Jun 27, 2017
…baseUrl for protractor (#6266)

#6173 added two new settings
to the serve task. The --publicHost setting is not respected as baseUrl
for protractor in the e2e-task.

With this fix, if --publicHost is set, it will be used as baseUrl for protrator.
danielronnkvist pushed a commit to danielronnkvist/angular-cli that referenced this pull request Jun 28, 2017
…baseUrl for protractor (angular#6266)

angular#6173 added two new settings
to the serve task. The --publicHost setting is not respected as baseUrl
for protractor in the e2e-task.

With this fix, if --publicHost is set, it will be used as baseUrl for protrator.
danielronnkvist pushed a commit to danielronnkvist/angular-cli that referenced this pull request Jun 28, 2017
…baseUrl for protractor (angular#6266)

angular#6173 added two new settings
to the serve task. The --publicHost setting is not respected as baseUrl
for protractor in the e2e-task.

With this fix, if --publicHost is set, it will be used as baseUrl for protrator.
filipesilva pushed a commit that referenced this pull request Jun 29, 2017
…baseUrl for protractor (#6266)

#6173 added two new settings
to the serve task. The --publicHost setting is not respected as baseUrl
for protractor in the e2e-task.

With this fix, if --publicHost is set, it will be used as baseUrl for protrator.
dond2clouds pushed a commit to d2clouds/speedray-cli that referenced this pull request Apr 23, 2018
…baseUrl for protractor (angular#6266)

angular#6173 added two new settings
to the serve task. The --publicHost setting is not respected as baseUrl
for protractor in the e2e-task.

With this fix, if --publicHost is set, it will be used as baseUrl for protrator.
@angular-automatic-lock-bot
Copy link

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

This action has been performed automatically by a bot.

@angular-automatic-lock-bot angular-automatic-lock-bot bot locked and limited conversation to collaborators Sep 12, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Invalid Host header after updating to 1.0.1
7 participants