Skip to content

Commit 0a08b4b

Browse files
fix(security): backport dev client access check from v5.2.1 using trusted header
1 parent c0c647f commit 0a08b4b

File tree

1 file changed

+6
-4
lines changed

1 file changed

+6
-4
lines changed

lib/Server.js

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
"use strict";
22

3-
function isChromiumBased(userAgentHeader) {
4-
return Boolean(userAgentHeader && userAgentHeader.includes('Chrome'));
3+
function isTrustedClient(req) {
4+
// Only allow injection if client explicitly identifies itself
5+
return req.headers["webpack-dev-server-client"] === "true";
56
}
67

78
const os = require("os");
@@ -2108,8 +2109,9 @@ class Server {
21082109
(middleware).waitUntilValid((stats) => {
21092110
res.setHeader("Content-Type", "text/html");
21102111

2111-
if (!isChromiumBased(req.headers['user-agent'])) {
2112-
res.end('<!DOCTYPE html><html><body><h2>Access blocked: Please use a Chromium-based browser (Chrome, Edge, etc.).</h2></body></html>');
2112+
if (!isTrustedClient(req)) {
2113+
res.statusCode = 403;
2114+
res.end("Access denied: Missing required dev server client header.");
21132115
return;
21142116
}
21152117

0 commit comments

Comments
 (0)