Fix dev server rejecting non-localhost hosts when using FX_PROFILER_HOST

[ojuschugh1]

This PR fixes #5865

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.41%. Comparing base (f3f07c7) to head (b272f54).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5889   +/-   ##
=======================================
  Coverage   85.41%   85.41%           
=======================================
  Files         321      321           
  Lines       32157    32157           
  Branches     8865     8781   -84     
=======================================
  Hits        27468    27468           
  Misses       4253     4253           
  Partials      436      436           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[mstange]

Thanks! Some small comments but overall looks good.

[fatadel]

Hey @ojuschugh1,

Thanks a lot for the PR! It looks overall good, however, going thru the "Steps to reproduce" of the original issue still leads to the same error for me. Could you please have another look?

[ojuschugh1]

Hey @fatadel, good catch - the original fix only handled the proxy's own host check but missed that esbuild itself started validating the Host header since v0.25.0. When accessing via a LAN IP, the proxy was forwarding the original Host header (e.g. 192.168.1.100:4242) to esbuild, which rejected it with a 403.

I've pushed a fix that rewrites the Host header to match esbuild's bound address before proxying. Also added IPv6 wildcard support to isHostAllowed. Could you try again with the latest changes?

[fatadel]

The issue is indeed resolved now 🎉 Thanks for your PR, @ojuschugh1! LGTM.

I have only one nit comment though.

The variable name BASE_ALLOWED_HOSTS sounds weird to me, I think something like DEFAULT_ALLOWED_HOSTS or just ALLOWED_HOSTS (since the dynamic addition happens inside the function) would read more naturally. BASE implies a base class / inheritance relationship that doesn't really exist here. Wdyt?

[ojuschugh1]

Done :D

[fatadel]

Thanks for your contribution, @ojuschugh1!