fix: preserve HTTPS/HTTP2 host port in @cloudflare/vite-plugin requests

[intrdx]

Fixes #14931.

Preserve host and non-default port from Host / :authority when constructing Vite HTTPS/HTTP2 requests in @cloudflare/vite-plugin.

Under HTTPS, Vite uses HTTP/2. Pseudo-headers like :authority are skipped when building Fetch headers, so Host can be missing and host resolution falls back to localhost without :5173. Auth libraries like Clerk then build handshake redirect_url / X-Forwarded-Host from that broken origin and loop.

Changes

• Add getRequestHost() to resolve authority from Host, then :authority
• Use it in createRequestForIncomingMessage so request.url keeps host + non-default port
• In toMiniflareRequest, fall back to new URL(request.url).host when Host is absent so X-Forwarded-Host still gets e.g. localhost:5173
• Add cleartext HTTP/2 (h2c) tests that drive a real node:http2 server through createRequestHandler

Validated locally with an equivalent pnpm patch against @cloudflare/vite-plugin (Clerk handshake no longer drops :5173 under HTTPS).

Related: #8684 / #8706, #10884, #13801 / #13920

---

• Tests
  • Tests included/updated
  • Manual testing has been completed as follows:
    • Vite server.https (mkcert) + --host
    • Open https://localhost:5173 with Clerk middleware
    • Confirm handshake Location / redirect_url keeps :5173 (no redirect loop to https://localhost/)
    • Confirm HTTP http://localhost:5173 still works
• Public documentation
  • Documentation not necessary because: bug fix restoring correct request origin/port behavior; no new public API

---

[changeset-bot]

🦋 Changeset detected

Latest commit: 94e47f4

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@cloudflare/vite-plugin	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[workers-devprod]

Codeowners approval required for this PR:

• ✅ @cloudflare/wrangler

Show detailed file reviewers

[pkg-pr-new]

@cloudflare/autoconfig

npm i https://pkg.pr.new/@cloudflare/autoconfig@14933

@cloudflare/build-output-utils

npm i https://pkg.pr.new/@cloudflare/build-output-utils@14933

@cloudflare/codemods

npm i https://pkg.pr.new/@cloudflare/codemods@14933

@cloudflare/config

npm i https://pkg.pr.new/@cloudflare/config@14933

create-cloudflare

npm i https://pkg.pr.new/create-cloudflare@14933

@cloudflare/deploy-helpers

npm i https://pkg.pr.new/@cloudflare/deploy-helpers@14933

@cloudflare/kv-asset-handler

npm i https://pkg.pr.new/@cloudflare/kv-asset-handler@14933

miniflare

npm i https://pkg.pr.new/miniflare@14933

@cloudflare/pages-functions

npm i https://pkg.pr.new/@cloudflare/pages-functions@14933

@cloudflare/pages-shared

npm i https://pkg.pr.new/@cloudflare/pages-shared@14933

@cloudflare/unenv-preset

npm i https://pkg.pr.new/@cloudflare/unenv-preset@14933

@cloudflare/vite-plugin

npm i https://pkg.pr.new/@cloudflare/vite-plugin@14933

@cloudflare/vitest-plugin

npm i https://pkg.pr.new/@cloudflare/vitest-plugin@14933

@cloudflare/workers-auth

npm i https://pkg.pr.new/@cloudflare/workers-auth@14933

@cloudflare/workers-editor-shared

npm i https://pkg.pr.new/@cloudflare/workers-editor-shared@14933

@cloudflare/workers-utils

npm i https://pkg.pr.new/@cloudflare/workers-utils@14933

wrangler

npm i https://pkg.pr.new/wrangler@14933

commit: 94e47f4

[NuroDev]

Overall this looks good to me @intrdx
Though it looks like CI tests are failing and need fixing. Once those are fixed we can get this merged.

[workers-devprod]

Codeowners reviews satisfied

[workers-devprod]

Codeowners approval required for this PR:

• ✅ @cloudflare/wrangler

Show detailed file reviewers

[workers-devprod]

Codeowners approval required for this PR:

• ✅ @cloudflare/wrangler

Show detailed file reviewers

[petebacondarwin]

We recently landed #14994, a large change to Miniflare's configuration internals that touched ~177 files across the repo. Leaving this PR on its old base was likely to cause conflicts, so we've rebased it onto the latest main and force-pushed the result.

Your local copy of this branch is now out of date. Before you push again, please reset to the new version:

git fetch origin
git checkout fix/vite-plugin-https-http2-host-port
git reset --hard origin/fix/vite-plugin-https-http2-host-port

Because the base moved a long way, it's also worth reinstalling before you carry on — the lockfile changed:

pnpm install

Sorry for the interruption. If the rebase looks wrong, or CI now fails in a way that seems related to the Miniflare config change rather than your own work, comment here and we'll help get it sorted.

[workers-devprod]

Codeowners approval required for this PR:

• ✅ @cloudflare/wrangler

Show detailed file reviewers

[intrdx]

@NuroDev, ready to merge now.

[intrdx]

@NuroDev Circling back, CI failures after your approval are fixed, and this is still the only PR with a maintainer approve for issue #14931.

There are now three other PRs for the same issue (#15237, #15519, #15533). #15533 from @vahidshaik1901 looks great. Can adopt the cleaner createRequestForIncomingMessage + real h2c test approach from #15533 on this branch in case you'd rather merge here than restart review on a newer PR. Goal is just to ship the port bug fix as soon as possible.

[vahidshaik1901]

@intrdx Please do. #14933 has carried the approval since August and is the right one to land; my only interest is the fix shipping, and a fourth PR in the queue does not help with that.

Take getRequestHost(), the toMiniflareRequest() fallback and the h2c tests from #15533 as they are. With the helper inside createRequestForIncomingMessage() the caller no longer has to resolve or pass host itself, and the tests drive a real node:http2 server through createRequestHandler, so they guard the actual :authority path. Before the fix they fail with expected 'http://localhost/path' to be 'http://127.0.0.1:<port>/path' and expected null to be '127.0.0.1:<port>'. I did not set Host on the request explicitly; keeping that from your version does not conflict, since the X-Forwarded-Host fallback only applies when Host is absent.

A Co-authored-by trailer would be appreciated if you lift them wholesale, though it is not a condition. I will close #15533 once your branch carries the change, so reviewers have one PR to look at.

[workers-devprod]

Codeowners approval required for this PR:

• ✅ @cloudflare/wrangler

Show detailed file reviewers

[devin-ai-integration]

Devin Review found 1 potential issue.

1 flag not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)

[intrdx]

Done @vahidshaik1901, let me know if you want anything tweaked.

[vahidshaik1901]

Verified: the utils.ts and utils.spec.ts hunks here are now byte-identical to #15533, and CI is green. Nothing to tweak from my side, and thank you for the trailer. Closing #15533 in favour of this PR.