Skip to content

feat(frontend): allow local->staging tunnel in dev#5030

Merged
jog1t merged 1 commit into
mainfrom
05-08-feat_frontend_allow_local-_staging_tunnel_in_dev
May 15, 2026
Merged

feat(frontend): allow local->staging tunnel in dev#5030
jog1t merged 1 commit into
mainfrom
05-08-feat_frontend_allow_local-_staging_tunnel_in_dev

Conversation

@jog1t
Copy link
Copy Markdown
Contributor

@jog1t jog1t commented May 11, 2026

Description

Please include a summary of the changes and the related issue. Please also include relevant motivation and context.

Type of change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • This change requires a documentation update

How Has This Been Tested?

Please describe the tests that you ran to verify your changes.

Checklist:

  • My code follows the style guidelines of this project
  • I have performed a self-review of my code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • My changes generate no new warnings
  • I have added tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes

@claude
Copy link
Copy Markdown
Contributor

claude Bot commented May 11, 2026

Code Review: PR #5030feat(frontend): allow local->staging tunnel in dev

Summary: This PR adds one line to frontend/vite.config.ts, allowing the Vite dev server to serve requests arriving via the local.staging.rivet.dev hostname. This enables a local-to-staging reverse tunnel workflow where a developer's local Vite dev server is reachable through the staging subdomain.


What the change does

// frontend/vite.config.ts, inside server: { ... }
allowedHosts: ["local.staging.rivet.dev"],

Vite's allowedHosts list prevents DNS rebinding attacks by blocking requests whose Host header doesn't match. Adding an entry here is the correct and minimal mechanism for allowing a tunnel to reach the local dev server.


Assessment

No functional or correctness issues. The change is scoped exclusively to the server block (local dev), not preview or build, so it has zero effect on production artifacts.

Convention checks (CLAUDE.md):

  • TypeScript only — no Rust conventions apply.
  • No new imports, no logic changes, no new dependencies.
  • The PR title follows conventional commits (feat(frontend): ...). Minor note: since this is purely a developer-experience config tweak rather than a user-facing feature, chore(frontend): ... would arguably be more accurate, but feat is not wrong.

Security:

  • allowedHosts is a dev-server-only guard. It does not expose any new network port or service; the developer's machine must already have the tunnel agent running for this to do anything. The domain (local.staging.rivet.dev) matches the project's staging subdomain convention and is not a wildcard, so this is as narrow as it can be.
  • The proxy target remains http://localhost:6420. A tunnel arriving via local.staging.rivet.dev still only talks to localhost on the dev machine — no cross-origin risk is introduced.

Potential concern — hardcoded single hostname:

The current list contains exactly one entry. If other developers need different tunnel subdomains (e.g. local-2.staging.rivet.dev for a second team member, or a different pattern in self-hosted setups), they will need another PR. Consider whether this should be driven by an env var:

// Example: VITE_ALLOWED_TUNNEL_HOST=local.staging.rivet.dev
server: {
    allowedHosts: env.VITE_ALLOWED_TUNNEL_HOST
        ? [env.VITE_ALLOWED_TUNNEL_HOST]
        : [],
    ...
}

This is a suggestion, not a blocker — the hardcoded value is fine for now if local.staging.rivet.dev is a shared, stable hostname for this tunnel.

Missing allowedHosts on preview: The preview block also serves on port 43708. If the tunnel is ever used against a vite preview build, it would still be blocked there. This is likely intentional (preview is not a dev workflow), but worth being aware of.


Verdict

The change is correct, minimal, and appropriate for its stated purpose. No blocking issues. The env-var suggestion above is the only meaningful follow-up to consider if the tunnel hostname needs to vary per developer.

@jog1t jog1t force-pushed the 05-08-feat_frontend_allow_local-_staging_tunnel_in_dev branch from 9368b87 to a664735 Compare May 11, 2026 18:49
@jog1t jog1t force-pushed the 05-08-refactor_frontend_better_gateway_errors branch from a460166 to 8656480 Compare May 11, 2026 18:49
@jog1t jog1t force-pushed the 05-08-feat_frontend_allow_local-_staging_tunnel_in_dev branch from a664735 to cb17d47 Compare May 15, 2026 19:30
@jog1t jog1t force-pushed the 05-08-refactor_frontend_better_gateway_errors branch from 8656480 to 97eef41 Compare May 15, 2026 19:30
@jog1t jog1t mentioned this pull request May 15, 2026
11 tasks
Copy link
Copy Markdown
Contributor Author

jog1t commented May 15, 2026

Merge activity

  • May 15, 7:36 PM UTC: A user started a stack merge that includes this pull request via Graphite.
  • May 15, 7:52 PM UTC: Graphite rebased this pull request as part of a merge.
  • May 15, 7:52 PM UTC: @jog1t merged this pull request with Graphite.

@jog1t jog1t changed the base branch from 05-08-refactor_frontend_better_gateway_errors to graphite-base/5030 May 15, 2026 19:49
@jog1t jog1t changed the base branch from graphite-base/5030 to main May 15, 2026 19:50
@jog1t jog1t force-pushed the 05-08-feat_frontend_allow_local-_staging_tunnel_in_dev branch from cb17d47 to 455ac95 Compare May 15, 2026 19:51
@jog1t jog1t merged commit afe700d into main May 15, 2026
8 of 11 checks passed
@jog1t jog1t deleted the 05-08-feat_frontend_allow_local-_staging_tunnel_in_dev branch May 15, 2026 19:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant