15.2.3: allowedDevOrigins not working, breaking hot-reload for subdomains. Reverted to 15.2.1 for now.

[sbkl]

Summary

Since I upgraded to Nextjs version 15.2.3, I get the cross-origin request blocked warning and hot-reloading doesn't work on app.localhost:3000 for instance.

Anything I am missing to make it work? Reverting to 15.2.1 works.

Additional information

Below my next.config.ts

  allowedDevOrigins: ["app.localhost:3000", "*.localhost:3000"],
  experimental: {
    serverActions: {
      allowedOrigins: ["app.localhost:3000", "*.localhost:3000"],
    },
  },

Example

No response

[rosswilson2306]

I'm having this issue also. The issue I seem to have is that I use different domains set in /etc/hosts for 127.0.0.1 . I was able to resolve by adding the domains I set in /etc/hosts to allowDevOrigins but isn't really practical as I can't commit this change.

I guess this might be a security feature though rather than a bug.

[aufy1]

Wasted about 5 hours searching how to fix this because HMR wasn't working on dev. Sick. Thank you

[htetshan]

Good at security but so much busy in dev stage while showing my project manager

[farsite-dev-admin]

Can confirm this issue, also affects 15.2.2 but not 15.2.1. Because of this all my fonts were broken were as well as hot module reloading which was was an annoying rabbit hole to go down.

[weisisheng]

Painful, ongoing

[mateusnc]

Upgrading to 15.3.4 fixed the problem for me.

[Ankit-Devslane]

I am using same 15.3.4 version. Issue still persist from me, can you add some detail how you doing that.
I have added subdomains in my '/etc/hosts' file, and same in allowedDevOrigins.

[mateusnc]

Simply upgrading my project's dependencies fixed the "content blocked" errors I was experiencing with local subdomains.

But if you are trying to get the custom domain from the host header note that the value will always be just "localhost" in NextJS, for that you would need to use a domain other than "localhost" and place it in the hosts as you said.

What I did for this was setting up a personal domain that I own to 127.0.0.1 and used that subdomain like app.example.com instead of app.localhost without changing my hosts file.

[om4rAb]

iv come across something similar and id like your help, all am doing is forwarding a port using vs code to test the app on my phone
the moment I click on something like sign-in with google i get this error INVALID SERVER ACTION REQUEST (see image)
I also have this url set in allowDevOrigins see image 2

nextjs v: 16.3.5

[delt4-haze]

In Next.js 15.2+, allowedDevOrigins enforces strict origin matching for cross-origin WebSockets and hot-reloading on subdomains.

To fix this, make sure to include the explicit protocol (http://) or format your origins correctly:

// next.config.ts
import type { NextConfig } from 'next';

const nextConfig: NextConfig = {
  allowedDevOrigins: [
    'app.localhost:3000',
    'http://app.localhost:3000',
    '*.localhost:3000',
    'http://*.localhost:3000',
  ],
  experimental: {
    serverActions: {
      allowedOrigins: [
        'app.localhost:3000',
        '*.localhost:3000',
      ],
    },
  },
};

export default nextConfig;