webpack-dev-server: "Invalid Host/Origin Header" warning
PLEASE READ
We are working on this problem. It is regression problem after fixing security error. Security issues are always high priority and we would not want to revert it, but it is require some changes in https://github.com/sockjs/sockjs-node/pull/247, we have workaround for this problem https://github.com/webpack/webpack-dev-server/pull/1608, but need some feedback. Feel free to feedback.
Fast workaround (put it in your devServer property in config):
disableHostCheck: true
We apologize for the situation. Thanks for helping us do webpack better. ⭐ ⭐ ⭐
- Operating System: macos 10.14.2
- Node Version: 11.5.0
- NPM Version: 6.4.1
- webpack Version: 4.28.1
- webpack-dev-server Version: 3.1.11
- This is a bug
Code
// webpack.config.js
const path = require('path');
const HtmlWebpackPlugin = require('html-webpack-plugin');
const MiniCssExtractPlugin = require('mini-css-extract-plugin');
module.exports = {
entry: [
'./src/main.css',
'./src/main.js'
],
output: {
path: path.resolve(__dirname, 'dist'),
filename: 'index.js'
},
plugins: [
new HtmlWebpackPlugin({
template: './src/main.html'
}),
new MiniCssExtractPlugin({
filename: 'index.css'
})
],
module: {
rules: [
{
test: /\.css$/,
use: [
MiniCssExtractPlugin.loader,
'css-loader'
]
},
{
test: /\.js$/,
exclude: /node_modules/,
use: 'babel-loader'
}
]
},
stats: {
children: false,
modules: false
},
devServer: {
proxy: {
'/api': 'http://localhost:3000'
},
stats: {
children: false,
modules: false
}
}
};
Expected Behavior
No warnings
Actual Behavior
Getting “Invalid Host/Origin Header” warning in browser console
For Bugs; How can we reproduce the behavior?
install webpack-dev-server@3.1.11 and run (v3.1.10 working as expected).

About this issue
- Original URL
- State: closed
- Created 6 years ago
- Reactions: 89
- Comments: 59 (22 by maintainers)
Links to this issue
Commits related to this issue
- temp disable dev serve host check: https://github.com/webpack/webpack-dev-server/issues/1604 — committed to SFDO-Tooling/MetaDeploy by jgerigmeyer 6 years ago
- Update webpack.config.js https://github.com/webpack/webpack-dev-server/issues/1604#issuecomment-449465737 — committed to sugyan/shogi-dataset by sugyan 6 years ago
- Fix checkHost fixed #1604 — committed to 3846masa-tmp/webpack-dev-server by 3846masa 6 years ago
- disable host check on webpack-dev-server (webpack/webpack-dev-server#1604) — committed to endel/colyseus-babylonjs-boilerplate by endel 6 years ago
- hey-hkul-hours-web - fixed infinite "Invalid Host/Origin Header" warning problem (reference: https://github.com/webpack/webpack-dev-server/issues/1604#issue-393549402) htbkoo/hey-hkul-hours — committed to htbkoo/hey-hkul-hours by htbkoo 6 years ago
- hey-hkul-hours-web - fixed infinite "Invalid Host/Origin Header" warning problem (reference: https://github.com/webpack/webpack-dev-server/issues/1604#issue-393549402) htbkoo/hey-hkul-hours — committed to htbkoo/hey-hkul-hours-web-vue by htbkoo 6 years ago
- 📦 🛢 🙀 Merge branch 'master' into record-logs-on-model * master: (60 commits) 📦 🙀 Upgrade deps; pin redis back to <3.0 Update sphinx from 1.8.2 to 1.8.3 Update cumulusci from 2.2.4 to 2.2.5... — committed to SFDO-Tooling/MetaDeploy by jgerigmeyer 5 years ago
- disableHostCheck: true as per https://github.com/webpack/webpack-dev-server/issues/1604 Signed-off-by: Andrew Welch <andrew@nystudio107.com> — committed to nystudio107/craft-webperf by khalwat 5 years ago
- disableHostCheck: true as per https://github.com/webpack/webpack-dev-server/issues/1604 Signed-off-by: Andrew Welch <andrew@nystudio107.com> — committed to nystudio107/annotated-webpack-config by khalwat 5 years ago
- disableHostCheck: true as per https://github.com/webpack/webpack-dev-server/issues/1604 Signed-off-by: Andrew Welch <andrew@nystudio107.com> — committed to nystudio107/craft-seomatic by khalwat 5 years ago
- disableHostCheck: true as per https://github.com/webpack/webpack-dev-server/issues/1604 Signed-off-by: Andrew Welch <andrew@nystudio107.com> — committed to nystudio107/craft-retour by khalwat 5 years ago
- disableHostCheck: true as per https://github.com/webpack/webpack-dev-server/issues/1604 Signed-off-by: Andrew Welch <andrew@nystudio107.com> — committed to nystudio107/craft-imageoptimize by khalwat 5 years ago
- disableHostCheck: true as per https://github.com/webpack/webpack-dev-server/issues/1604 Signed-off-by: Andrew Welch <andrew@nystudio107.com> — committed to nystudio107/craft-instantanalytics by khalwat 5 years ago
- chore: Disable webpack-dev-server host checking This fixes the "Invalid Host/Origin header" error. See https://github.com/webpack/webpack-dev-server/issues/1604 — committed to cozy/cozy-banks by deleted user 5 years ago
- 解决webpack-dev-server升级问题引起的host检测异常,https://github.com/webpack/webpack-dev-server/issues/1604 — committed to umi-soft/element-admin by deleted user 5 years ago
- feat(webpack-dev-server): up version to 3.1.4 Because issue https://github.com/webpack/webpack-dev-server/issues/1604 — committed to alfa-laboratory/arui-scripts by Luchanso 5 years ago
- disableHostCheck for webpack-dev-server https://github.com/webpack/webpack-dev-server/issues/1604 — committed to ankurk91/laravel-bundler by ankurk91 5 years ago
- Add disableHostCheck: true, see https://github.com/webpack/webpack-dev-server/issues/1604. — committed to samikeijonen/wp-gutenberg-hot-module-replacement by samikeijonen 5 years ago
- Workaround fix for webpack-dev-server issue https://github.com/webpack/webpack-dev-server/issues/1604 — committed to GSA/code-gov-front-end by saracope 5 years ago
- Fix "Invalid Host/Origin Header" HMR websocket error. https://github.com/webpack/webpack-dev-server/issues/1604 — committed to v24dc/js-templates by v24dc 5 years ago
@mrbbm I just had that very problem after upgrading my project to angular 7.2.0. I fixed it by modifying my
package.jsonfile as so:@ravshansbox it is security fix, looks you origin than you use in config, you can use
disableHostCheck: truein you case, anyway can you create minimum reproducible test repo?Even with disableHostCheck now after updating I can not get rid of these errors.
This is happening now on webpack 5 and disableHostCheck is not part of the api anymore. Any thoughts?
It happens again for me with the following versions:
Does it occur to you guys?
I am running 3.11.0 webpack-dev-server and still having this problem after specifying
disableHostCheck: trueLooks like the issue has been solved. Thanks
This also affects projects created with
@vue/cli- tested a few minutes ago with3.1.12.with
disableHostCheck: truethere is no warning.Yes, it seems the npmjs security team does not know what is going on.
Reported https://npm.community/t/advisory-725-inconsistently-marks-affected-versions/4333
I also am getting this error in Firefox 64.0 with version 3.1.11. Reverting to 3.1.10 fixes it.
@kevinmu17 the
disableHostCheck: trueoption was removed in favor ofallowedHosts: "all", for more information please refer to our migration guide - https://github.com/webpack/webpack-dev-server/blob/master/migration-v4.mdwebpack-dev-server@3.1.14 is not fixed this issue
Yep, 3.1.14 works fine 👍
#1608 is working for me (Node 11.5.0 and SockJS 0.3.19)
If you’re using @angular-builders/custom-webpack try this:
@carlosgeos
Thanks for your reply. I would like to know where could I add in my Angular 7 project, there won’t be any file namely webpack.config
@davidpelayo yes, it is happening for me as well with the latest versions of both
webpack-cliandwebpack-dev-serverFor now, I’ve added:
…which skirts around the issue.
I can also confirm that the issue still exists
I am seeing this issue as well with 3.1.11. Rolling back to 3.1.10 fixes it.
This link should be available on https://webpack.js.org/configuration/dev-server/ This was a live saver, I was banging my head, the information is very well explained and it took me a few hours to migrate. Thank you very much for pointing this out!
I see this message consistently when I run my project via Fiddler at localhost.fiddler:4200 and not when I use localhost:4200.
@khalwat >
Where could I add this
disableHostCheck: true,?I tried to add workaround (#1608). It works and resolves this issue in my environment. Please check it.
@3846masa let’s wait some time and revert it, maybe we can implement workaround on our side, need investigate, feel free to do it, thanks
Please don’t spam
Same problem hereorissue still exists, better create minimum reproducible test repo, it is allow to fix all edge cases, thanks!Also, got this issue after upgrading to 3.1.11