feat: add new allowedHosts option

[ematipico]

Changes

Closes #13060

This PR adds a new allowedHosts and --allowed-hosts options.

This options isn't passed to the node adapter yet, we will have to figure out how to use it in the preview server.

Testing

I don't know how to test this functionality, help would be appreciated.

Docs

Will send a PR

[changeset-bot]

🦋 Changeset detected

Latest commit: 4e03d68

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

This PR is blocked because it contains a minor changeset. A reviewer will merge this at the next release if approved.

[codspeed-hq]

CodSpeed Performance Report

Merging #13278 will not alter performance

_{Comparing feat/add-allowed-hosts (4e03d68) with main (2e1321e)}

Summary

✅ 6 untouched benchmarks

[pkg-pr-new]

astro

npm i https://pkg.pr.new/astro@13278

@astrojs/cloudflare

npm i https://pkg.pr.new/@astrojs/cloudflare@13278

@astrojs/netlify

npm i https://pkg.pr.new/@astrojs/netlify@13278

@astrojs/node

npm i https://pkg.pr.new/@astrojs/node@13278

@astrojs/vercel

npm i https://pkg.pr.new/@astrojs/vercel@13278

commit: 727c386

[florian-lefebvre]

I think my concern is that we are a bit conflicting with the vite option. What happens to it? Is it not used at all anymore? Should we warn if used?

[ArmandPhilippot]

LGTM, I just left some nit related to the doc.

[sarah11918]

Looks great here, just some small thoughts!

Fun fact, I literally just configured vite.server.allowHosts myself yesterday to allow my dev server to work in Gitpod 😄

Also noting that I didn't notice any new error messages added along with this feature.

[sarah11918]

Description looks great!

I noticed that Vite's documentation includes multiple warnings (which hosts can I trust? using true is dangerous and we suggest you don't do it...) Do we feel the need for any of that here?

Otherwise assuming it renders fine in preview, looks good to me!

[ematipico]

I am a bit conflicted, so I leave the decision to you. My idea was to defer the more "in-depth" description to vite, but happy to change it. Let me know

[sarah11918]

You're pulling a Matthew and not filling in the blank, @ematipico !! 😂

I think we can put the extra note here in the changelog. If you can fill in the blank, I think it would be a useful addition:

This is useful for/when...

(I just made up a couple of things that might not be the right way of saying it. I just know that I needed to add Gitpod to my allowed list in order to run the dev server this weekend, so that's for sure one use case.)

Suggested change

	Now you can specify the hostnames that the dev and preview servers are allowed to respond to. This is useful for...
	Now you can specify the hostnames that the dev and preview servers are allowed to respond to. This is useful for allowing additional subdomains, or running the dev server in a web container.
	`allowedHosts` checks the Host header on HTTP requests from browsers and if it doesn't match, it will reject the request to prevent CSRF and XSS attacks.