Adds devmode.hostsAllowed property (#3104)

* Adds devmode.hostsAllowed property

* Note->plaintext; add reasoning

* First pass at editing.

* Second pass at editing.

---------

Co-authored-by: Mikhail Shabarov <61410877+mshabarov@users.noreply.github.com>
Co-authored-by: Russell J.T. Dyer <6652767+russelljtdyer@users.noreply.github.com>

articles/configuration/development-mode/dev-tools/index.adoc

@@ -1,6 +1,6 @@
 ---
 title: Development Tools
-description: Vaadin tools that are available when running applications in development mode.
+description: Vaadin tools available when running applications in development mode.
 order: 209
 ---
 
@@ -9,6 +9,11 @@ order: 209
 
 Boost productivity with the Vaadin Development Tools, such as Component Locator, that are available when running applications in development mode.
 
+Current and future functionality of Vaadin Development Tools may offer developers ways to alter the application configuration or even application code. Therefore, it may not be desirable to enable access to Development Tools for everyone -- even when running an application in development mode.
+
+By default, Development Tools can be accessed only from loopback addresses. To configure hosts for Development Tools access, please see `devmode.hostsAllowed` <<{articles}/configuration/properties/#properties,configuration property>>.
+
+
 == Topics
 
 section_outline::[]

articles/configuration/properties.adoc

@@ -109,6 +109,10 @@ The following table contains the properties that are defined in the [classname]`
 |`false`
 |Closes the Vaadin session if no UI is active. A UI is considered active if it's open on the client-side and has any activity -- besides heartbeat requests. By default, heartbeat requests keep the Vaadin session open even when there is no user interaction. Set to `true` to close idle sessions. See `heartbeatInterval` below.
 
+|`devmode.hostsAllowed`
+|`null`
+|Defines the hosts allowed to access Vaadin development tools. A comma-separated list of allowed hosts should be provided as the value. The `?` and `*` wildcards can be used (e.g., `192.168.1.*,172.17.?.*`). Loopback addresses are always allowed, regardless of the value set here.
+
 |`devmode.liveReload.enabled`
 |`true`
 |Enables live reload. When using a server-side <<live-reload/index#, live reload tool>>, the browser is refreshed after code is rebuilt on the server. Set to `false` to disable automatic reloading of the browser. This applies only to development mode.