15.2.3: allowedDevOrigins not working, breaking hot-reload for subdomains. Reverted to 15.2.1 for now.

[sbkl]

Summary

Since I upgraded to Nextjs version 15.2.3, I get the cross-origin request blocked warning and hot-reloading doesn't work on app.localhost:3000 for instance.

Anything I am missing to make it work? Reverting to 15.2.1 works.

Additional information

Below my next.config.ts

  allowedDevOrigins: ["app.localhost:3000", "*.localhost:3000"],
  experimental: {
    serverActions: {
      allowedOrigins: ["app.localhost:3000", "*.localhost:3000"],
    },
  },

Example

No response

[rosswilson2306]

I'm having this issue also. The issue I seem to have is that I use different domains set in /etc/hosts for 127.0.0.1 . I was able to resolve by adding the domains I set in /etc/hosts to allowDevOrigins but isn't really practical as I can't commit this change.

I guess this might be a security feature though rather than a bug.

[aufy1]

Wasted about 5 hours searching how to fix this because HMR wasn't working on dev. Sick. Thank you

[htetshan]

Good at security but so much busy in dev stage while showing my project manager

[farsite-dev-admin]

Can confirm this issue, also affects 15.2.2 but not 15.2.1. Because of this all my fonts were broken were as well as hot module reloading which was was an annoying rabbit hole to go down.

[weisisheng]

Painful, ongoing

[mateusnc]

Upgrading to 15.3.4 fixed the problem for me.

[Ankit-Devslane]

I am using same 15.3.4 version. Issue still persist from me, can you add some detail how you doing that.
I have added subdomains in my '/etc/hosts' file, and same in allowedDevOrigins.

[mateusnc]

Simply upgrading my project's dependencies fixed the "content blocked" errors I was experiencing with local subdomains.

But if you are trying to get the custom domain from the host header note that the value will always be just "localhost" in NextJS, for that you would need to use a domain other than "localhost" and place it in the hosts as you said.

What I did for this was setting up a personal domain that I own to 127.0.0.1 and used that subdomain like app.example.com instead of app.localhost without changing my hosts file.