feat(server): support multiple hosts in __VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS (#21501)

Co-authored-by: sapphi-red <49056869+sapphi-red@users.noreply.github.com>

Author: ctate

docs/config/server-options.md

@@ -57,7 +57,7 @@ Setting `server.allowedHosts` to `true` allows any website to send requests to y
 :::
 
 ::: details Configure via environment variable
-You can set the environment variable `__VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS` to add an additional allowed host.
+You can set the environment variable `__VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS` to add additional allowed hosts. Use commas to separate multiple hosts (e.g., `host1.example.com,host2.example.com`).
 :::
 
 ## server.port

packages/vite/src/node/__tests__/config.spec.ts

@@ -5,9 +5,11 @@ import { afterEach, describe, expect, test, vi } from 'vitest'
 import type { InlineConfig, PluginOption } from '..'
 import type { UserConfig, UserConfigExport } from '../config'
 import { defineConfig, loadConfigFromFile, resolveConfig } from '../config'
+import { resolveServerOptions } from '../server'
 import { resolveEnvPrefix } from '../env'
 import { hasBothRollupOptionsAndRolldownOptions, mergeConfig } from '../utils'
 import { createLogger } from '../logger'
+import type { Logger } from '../logger'
 
 describe('mergeConfig', () => {
   test('handles configs with different alias schemas', () => {
@@ -1417,3 +1419,106 @@ describe('loadConfigFromFile', () => {
     })
   })
 })
+
+describe('resolveServerOptions', () => {
+  const warnFn = vi.fn()
+  const logger = { warn: warnFn } as unknown as Logger
+
+  afterEach(() => {
+    delete process.env.__VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS
+  })
+
+  test('adds single host from __VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS', async () => {
+    process.env.__VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS = 'example.com'
+    const resolved = await resolveServerOptions(
+      '/root',
+      { allowedHosts: [] },
+      logger,
+    )
+    expect(resolved.allowedHosts).toEqual(['example.com'])
+  })
+
+  test('adds multiple hosts from __VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS', async () => {
+    process.env.__VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS =
+      'example.com,test.com,dev.example.org'
+    const resolved = await resolveServerOptions(
+      '/root',
+      { allowedHosts: [] },
+      logger,
+    )
+    expect(resolved.allowedHosts).toEqual([
+      'example.com',
+      'test.com',
+      'dev.example.org',
+    ])
+  })
+
+  test('trims whitespace from hosts in __VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS', async () => {
+    process.env.__VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS =
+      ' example.com , test.com , dev.example.org '
+    const resolved = await resolveServerOptions(
+      '/root',
+      { allowedHosts: [] },
+      logger,
+    )
+    expect(resolved.allowedHosts).toEqual([
+      'example.com',
+      'test.com',
+      'dev.example.org',
+    ])
+  })
+
+  test('filters empty hosts from __VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS', async () => {
+    process.env.__VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS =
+      'example.com,,test.com,,'
+    const resolved = await resolveServerOptions(
+      '/root',
+      { allowedHosts: [] },
+      logger,
+    )
+    expect(resolved.allowedHosts).toEqual(['example.com', 'test.com'])
+  })
+
+  test('appends to existing allowedHosts', async () => {
+    process.env.__VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS = 'new.com,another.com'
+    const resolved = await resolveServerOptions(
+      '/root',
+      { allowedHosts: ['existing.com'] },
+      logger,
+    )
+    expect(resolved.allowedHosts).toEqual([
+      'existing.com',
+      'new.com',
+      'another.com',
+    ])
+  })
+
+  test('does not modify allowedHosts when set to true', async () => {
+    process.env.__VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS = 'example.com'
+    const resolved = await resolveServerOptions(
+      '/root',
+      { allowedHosts: true },
+      logger,
+    )
+    expect(resolved.allowedHosts).toBe(true)
+  })
+
+  test('throw an error if it contains `"` or `\'` or `\\`', async () => {
+    const envs = ['"example.com"', "'example.com'", '\\example.com']
+    for (const env of envs) {
+      process.env.__VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS = env
+      const resolved = await resolveServerOptions(
+        '/root',
+        { allowedHosts: [] },
+        logger,
+      )
+      expect(resolved.allowedHosts).toEqual([])
+      expect(warnFn).toHaveBeenCalledWith(
+        expect.stringContaining(
+          'Skipping additional allowed hosts from environment variable due to reserved characters',
+        ),
+      )
+      warnFn.mockClear()
+    }
+  })
+})

packages/vite/src/node/server/index.ts

@@ -1188,6 +1188,8 @@ const _serverConfigDefaults = Object.freeze({
 export const serverConfigDefaults: Readonly<Partial<ServerOptions>> =
   _serverConfigDefaults
 
+const RESERVED_ALLOWED_HOSTS_CHARACTERS_RE = /[\\"']/
+
 export async function resolveServerOptions(
   root: string,
   raw: ServerOptions | undefined,
@@ -1266,8 +1268,21 @@ export async function resolveServerOptions(
     process.env.__VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS &&
     Array.isArray(server.allowedHosts)
   ) {
-    const additionalHost = process.env.__VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS
-    server.allowedHosts = [...server.allowedHosts, additionalHost]
+    const rawAdditionalHosts =
+      process.env.__VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS
+    if (RESERVED_ALLOWED_HOSTS_CHARACTERS_RE.test(rawAdditionalHosts)) {
+      logger.warn(
+        colors.yellow(
+          `${colors.bold('(!)')} Skipping additional allowed hosts from environment variable due to reserved characters. Received: "${rawAdditionalHosts}".`,
+        ),
+      )
+    } else {
+      const additionalHosts = rawAdditionalHosts
+        .split(',')
+        .map((host) => host.trim())
+        .filter(Boolean)
+      server.allowedHosts = [...server.allowedHosts, ...additionalHosts]
+    }
   }
 
   return server