diff --git a/.changeset/independent-origin-authorization.md b/.changeset/independent-origin-authorization.md index 1abba02cea..9d0f910c18 100644 --- a/.changeset/independent-origin-authorization.md +++ b/.changeset/independent-origin-authorization.md @@ -2,7 +2,7 @@ "webpack-dev-server": minor --- -Add `allowedOrigins` to say which pages may use the server — its HTTP endpoints, hot module replacement and proxied WebSockets — independently of `allowedHosts`, which goes back to checking `Host`. Nothing changes until it is set: the default, `"auto"`, keeps the rules derived from `allowedHosts`. A list allows the listed origins plus the page's own hostname (any port, loopback names counted as one, as before), answering them with CORS headers and allowing a plain `