rules-vite

RISK: Setting allowedHosts to 'all' or true disables Vite's DNS rebinding protection — any hostname (including attacker-controlled domains that resolve to your loopback address) can access the dev server and read local source files. FIX: remove allowedHosts or list only specific hostnames you control. Vite 5.4+ blocks all unknown hosts by default for this reason.

RISK: Setting cors:true or cors:{origin:'*'} on the Vite dev server or preview allows any origin to make credentialed cross-origin requests to your dev environment — this can leak session tokens or API responses to malicious pages open in the same browser. FIX: restrict to specific origins (e.g., cors:{origin:'http://localhost:3001'}) in dev configs.

RISK: Hardcoding a secret value in Vite's 'define' object inlines it as a string literal in the browser bundle — it is shipped to every end-user and visible in browser DevTools. FIX: use VITE_ prefixed environment variables from a .env file for non-sensitive build-time constants; never bundle secrets — move sensitive operations to a server-side API.

RISK: Exposing the Vite preview server on all interfaces (0.0.0.0 or host:true) makes the production-preview build accessible to any host on the network — unlike the dev server, the preview server has no HMR protections and serves the compiled bundle with all substituted constants. FIX: leave preview.host unset (binds to 127.0.0.1) or explicitly set it to '127.0.0.1'.

RISK: Setting secure:false in a Vite proxy config disables TLS certificate verification for the proxied backend — a self-signed or mis-issued cert silently passes, enabling MITM attacks against the proxied API. FIX: install a valid certificate for the backend, or use a local CA (mkcert) for development; only disable TLS verification in an isolated, non-networked environment.

Disabling server.fs.strict allows the Vite dev server to serve files outside of the workspace root. This is a potential directory traversal risk if not tightly controlled.

Setting server.host to true exposes the Vite dev server on the local network. Ensure you are not working on a public or untrusted network, as this allows others to access your development environment.