Fix the Vite "Blocked request. This host is not allowed" error

When you open a Vite dev server through a tunnel, a custom domain or a container, you may see this:

Blocked request. This host ("abc123.example.dev") is not allowed.
To allow this host, add "abc123.example.dev" to `server.allowedHosts` in vite.config.js.

Why Vite blocks the request

Your dev server has no login, so anyone who can reach it can read your source code. Without a check, a malicious website could use a DNS rebinding attack to point its own domain at your machine and read that code from your browser.

So Vite only answers requests for hostnames it trusts. By default that means localhost, domains under .localhost, and IP addresses. Any other name in the Host header gets this error.

Fix 1: allow that one host

Add the hostname to server.allowedHosts:

// vite.config.js
import { defineConfig } from "vite";

export default defineConfig({
	server: {
		allowedHosts: ["abc123.example.dev"],
	},
});

Fix 2: allow a domain and its subdomains

If the subdomain changes on every run, start the entry with a dot. .example.dev allows example.dev and everything under it:

export default defineConfig({
	server: {
		allowedHosts: [".example.dev"],
	},
});

Only add domains whose DNS you trust, and never a top-level domain like .com.

You can also set the __VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS environment variable, which is useful when you don't want a host in the committed config. Separate several hosts with commas.

What not to do

You will often see this suggested:

server: { allowedHosts: true }

This removes the error by turning the check off. Vite's documentation warns that any website can then send requests to your dev server and download your source code, so use an explicit list.

The other way: keep the host as localhost

Vite checks the Host header, so a tunnel that sends Host: localhost never triggers the error. hostc rewrites Host, Origin and Referer before a request reaches your server, so nothing in your config changes:

Your config is unchanged, so Vite's check stays on. Anyone with the public URL can reach your server, so be careful where you post it.