Update comment

bryphe-coder · bryphe-coder · commit 083920166936 · 2022-03-12T00:51:12.000Z
diff --git a/site/webpack.dev.ts b/site/webpack.dev.ts
@@ -22,7 +22,13 @@ const config: Configuration = {
   //
   // REMARK: needs webpack-dev-server import at top of file for typings
   devServer: {
-    allowedHosts: "all",
+    // allowedHosts are services that can access the running server. headers
+    // are attached to all responses by the dev server. In v1, we use CODERD_HOST for
+    // allowed host and origin in order to mitigate security risks. We don't have
+    // an equivalent in v2 (at the moment) - but we can allow localhost and cdr.dev,
+    // so that the site is accessible through dev urls.
+    // We don't want to use 'all' or '*' and risk a security hole in our dev environments.
+    allowedHosts: ["localhost", ".cdr.dev"],
 
     // client configures options that are observed in the browser/web-client.
     client: {
