# Allow a tunnel’s hostname in your dev server > The setting and value each dev server needs for qURL, ngrok and Cloudflare: Vite, Next.js, Angular, Astro, SvelteKit, Nuxt, webpack, Django and Rails. Source: https://layerv.ai/guides/allow-tunnel-hostname-in-dev-server/ --- [← All guides](https://layerv.ai/guides/) # Allow a tunnel’s hostname in your dev server Content updated October 25, 2026. ## Which setting lets my dev server accept a tunnel’s hostname? Dev servers reject unknown tunnel hosts. Vite-based servers use allowedHosts; Next.js uses allowedDevOrigins; Django uses ALLOWED\_HOSTS; Rails uses config.hosts. For qURL™, allow .qurl.site; in Next.js allowedDevOrigins, use the exact browser hostname instead. For ngrok, use your exact dev domain, including ngrok-free.dev if assigned. With qURL, the app stays on your machine with no public URL, and each link opens once. If you later need one permanent public hostname, ngrok’s dev domain fits. ## The setting and value for each dev server | Dev server | Setting | qURL | ngrok | Cloudflare Quick Tunnel | Also needed through qURL | Version | | ------------------ | ------------------------------------------------------------- | ------------------------------------------ | -------------------------- | -------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- | ---------------------------------- | | Vite | server.allowedHosts in vite.config.js | .qurl.site | your-domain.ngrok-free.app | .trycloudflare.com | Nothing else | Vite 8.3.4 | | Next.js | allowedDevOrigins in next.config.js | Your exact r\_….qurl.site browser hostname | your-domain.ngrok-free.app | your-tunnel.trycloudflare.com (update and restart next dev each run) | Your exact r\_….qurl.site host in experimental.serverActions.allowedOrigins, in development only, for Server Actions | Next.js 16.4.2 | | Angular (ng serve) | allowedHosts under the serve target’s options in angular.json | .qurl.site | your-domain.ngrok-free.app | .trycloudflare.com | ng serve --host 127.0.0.1, and a restart after editing | Angular CLI 22.2.3 | | Astro | server.allowedHosts in astro.config.mjs (Astro 5.4 and later) | .qurl.site | your-domain.ngrok-free.app | .trycloudflare.com | Nothing else | Astro 7.4.0 | | SvelteKit | server.allowedHosts in vite.config.js | .qurl.site | your-domain.ngrok-free.app | .trycloudflare.com | Share vite dev: form actions under vite preview need an exact trusted origin | SvelteKit 3.1.0 | | Nuxt | vite.server.allowedHosts in nuxt.config.ts | .qurl.site | your-domain.ngrok-free.app | .trycloudflare.com | Nothing else; avoid nuxt dev --public | Nuxt 4.6.2 | | webpack-dev-server | devServer.allowedHosts in webpack.config.js | .qurl.site | your-domain.ngrok-free.app | .trycloudflare.com | client.webSocketURL: auto://0.0.0.0:0/ws for hot reload, as through any HTTPS tunnel | webpack-dev-server 6.1.0 and 5.2.7 | | Django | ALLOWED\_HOSTS in settings.py, with localhost kept | .qurl.site | your-domain.ngrok-free.app | .trycloudflare.com | The exact browser https origin in CSRF\_TRUSTED\_ORIGINS, for form posts; no origin wildcard | Django 6.1.2 | | Rails | config.hosts in config/environments/development.rb | .qurl.site | your-domain.ngrok-free.app | .trycloudflare.com | A development-only exact browser-origin exception in ApplicationController, retaining the CSRF token check | Rails 8.1.4 | ## What you need - A dev server opened through a tunnel or qURL link - Its config file, named in the table ## Steps 1. ### Recognise the error Each dev server words it differently. Vite, and Angular, Astro, SvelteKit and Nuxt on top of it, answer “Blocked request. This host is not allowed”. Next.js logs “Blocked cross-origin request to Next.js dev resource”. webpack-dev-server answers “Invalid Host header”, Django “Invalid HTTP\_HOST header” (DisallowedHost), and Rails “Blocked hosts”. 2. ### Allow the hostnames your framework requires For host checks, a leading dot allows the domain and its subdomains, so the next link or tunnel run works too. Next.js checks browser origins instead: allow the exact browser hostname from the recipient in allowedDevOrigins, never a whole-domain wildcard. qURL and Cloudflare Quick Tunnels use a new subdomain each time; ngrok keeps one dev domain per account, so its exact name is enough. The table’s ngrok-free.app examples stand for your assigned hostname; use ngrok-free.dev if assigned. In Rails a leading dot covers only one more label, so .ts.net does not cover machine.tailnet.ts.net; use the tailnet’s own domain there. 3. ### Check form posts and hot reload through qURL A qURL link’s browser origin (r\_….qurl.site) differs from the host the app receives (c-….qurl.site). Servers that compare the two need one more setting, listed in the table: Next.js for Server Actions, Django and Rails for form posts. webpack-dev-server’s hot reload client needs client.webSocketURL behind any HTTPS tunnel. 4. ### Share it through qURL Publish the address the dev server listens on. The example uses Vite’s default port 5173; replace it with the port your app prints. Vite-based servers can listen only on the IPv6 address \[::1\], depending on localhost resolution. If publish cannot connect to 127.0.0.1, publish http://\[::1\]:PORT in quotes, or start the dev server with --host 127.0.0.1 and publish that address. Your app stays on this computer; nothing listens on your network. Each qurl share link opens once and expires within 24 hours. ``` qurl publish http://127.0.0.1:5173 qurl share ``` ## What the recipient sees With the domain allowed, the page loads through the link and hot reload connects. ## Which tool fits sharing a dev server with someone? | Option | Choose it when | Trade-off | | --------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- | | [qURL](https://layerv.ai/cli/) | qURL fits when particular people should open the dev server: one .qurl.site entry covers every qURL link, with no account and no public URL. | For qURL in Next.js, Django and Rails, trust the link’s exact browser address in development; the table lists the setting. | | [ngrok](https://layerv.ai/compare/qurl-vs-ngrok/) | ngrok fits when you want one stable URL: your ngrok dev domain stays the same, so one exact entry lasts in every framework. | ngrok needs an account and authtoken, the URL is public, and free-plan browser visitors see a warning page first. | | [Cloudflare Quick Tunnels](https://layerv.ai/compare/qurl-vs-cloudflare-quick-tunnels/) | A Cloudflare Quick Tunnel fits a no-account look: .trycloudflare.com covers the hostname that changes every run. | A Cloudflare Quick Tunnel URL is public unless you set --allowed-mail, and Quick Tunnels do not support Server-Sent Events. | | [Tailscale Funnel](https://layerv.ai/compare/qurl-vs-tailscale-funnel/) | Tailscale Funnel fits when the machine is already on a tailnet: its ts.net name is stable, so allow that exact name. | Tailscale Funnel makes the dev server public to anyone on the internet, with no access control on Funnel traffic. | ## Troubleshooting | If you see | Do this | | ---------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | The setting is in place but the page is still blocked | The server did not reload its config. Vite, Astro, SvelteKit and Nuxt apply config edits on their own; ng serve, webpack-dev-server, Next.js and Rails need a restart. | | The page loads, but form posts fail through qURL and not through ngrok | The server compares the browser’s origin with its own host, and under qURL those differ. Add the extra setting from the table’s qURL column. | | qurl publish says the local app is not accepting TCP connections | Start the app first and check that curl works on the same address. qurl publish connects to localhost as 127.0.0.1, so if your app listens only on IPv6 (on macOS or Linux, lsof -iTCP -sTCP:LISTEN -nP shows \[::1\]), publish 'http://\[::1\]:PORT' instead, or start the dev server with --host 127.0.0.1 and publish that address. Neither requires listening on your LAN. Keep the quotes: zsh treats the brackets as a pattern. | | The recipient sees “Access link invalid” | The link was already used or has expired. Run qurl share again and send the new link. | | The recipient sees “Resource not found” | The resource was deleted after the link was made. Publish the app again, then run qurl share and send the new link. | | publish rejects http://127.0.0.1 with “only HTTPS URLs are allowed”, or asks you to log in | You have a CLI older than 3.0\. On macOS run brew update, then brew upgrade qurl; elsewhere install the latest release again. After updating, qurl --version should print 3.4.1 or later. | | publish prints no Access: line, or the Access: line says public and you did not ask for public | With no Access: line, the CLI is older than 3.4.1: on macOS run brew update, then brew upgrade qurl; elsewhere install the latest release again. A resource that an older CLI published is public unless you published it with --private, and anyone who has the CRID of a public resource can open it. To make a public resource private, run qurl delete and publish again with qurl 3.4.1 or later. The new resource is private and has a new CRID. | | publish says this Linux session “can’t reach a systemd user manager” | You are in a container or sandbox without a user service manager. Run qurl publish with --foreground; sharing lasts as long as that process runs. | | publish says “Quota Exceeded” with “protected resource limit reached”, or “Your qURL account has reached a plan limit” | You can see this without an account: a device with no account can keep up to 3 active resources, with links that last up to 24 hours. Run qurl list --status active, then qurl delete for any you no longer need (it asks you to confirm; --yes skips that). qurl stop keeps the resource, so it does not free a slot. | ## Frequently Asked Questions Why do dev servers block unknown hosts? To stop DNS rebinding, where a website you visit points its own name at your machine and reads your dev server. Vite added its check in 6.0.9, 5.4.12 and 4.5.6 (advisory GHSA-vg6x-rcgg-rjx6), and Rails added host authorization in 6.0 for the same reason. Can I just turn the check off? Every server has a switch: allowedHosts true or all, ALLOWED\_HOSTS \["\*"\], clearing config.hosts, ng serve --allowed-hosts, nuxt dev --public. Each lets any website that rebinds a name reach your dev server. List the domains you use instead. Which extra setting do form posts need through qURL? Through qURL the browser is on r\_….qurl.site while the app receives c-….qurl.site. Next.js Server Actions and Django and Rails form posts compare the two, so trust that exact browser address in development. The table lists the setting for each; update it when the browser hostname changes. Who else can reach my app while the link is open? Opening the link admits the network address it was opened from for the session, which lasts 1 hour by default. Other devices that share that public IP address, such as people on the same office or café network or VPN, can reach the app until the session ends. By default a link admits whoever opens it; access rules set through the API, such as IP allow and deny lists, can restrict that. Keep your app’s own sign-in for anything sensitive. ## Related Resources [Guide: Fix Vite “Blocked request” →](https://layerv.ai/guides/fix-vite-blocked-request-host-not-allowed/) [Guide: Fix Next.js blocked dev requests →](https://layerv.ai/guides/fix-nextjs-blocked-cross-origin-dev-request/) [Guide: Fix Angular “Blocked request” →](https://layerv.ai/guides/fix-angular-blocked-request-allowed-hosts/) [Guide: Fix Astro “Blocked request” →](https://layerv.ai/guides/fix-astro-blocked-request-allowed-hosts/) [Guide: Fix SvelteKit “Blocked request” →](https://layerv.ai/guides/fix-sveltekit-blocked-request-allowed-hosts/) [Guide: Fix Nuxt “Blocked request” →](https://layerv.ai/guides/fix-nuxt-blocked-request-allowed-hosts/) [Guide: Fix webpack-dev-server “Invalid Host header” →](https://layerv.ai/guides/fix-webpack-dev-server-invalid-host-header/) [Guide: Fix Django “Invalid HTTP\_HOST header” →](https://layerv.ai/guides/fix-django-disallowedhost-invalid-http-host/) [Guide: Fix Rails “Blocked hosts” →](https://layerv.ai/guides/fix-rails-blocked-hosts/) [Guide: Fix hot reload through a tunnel →](https://layerv.ai/guides/fix-hot-reload-through-a-tunnel/) ## Publish your app now Install the CLI, then run one command. No sign-up, no API key. [Install the CLI ↗](https://layerv.ai/cli/) --- *This markdown version is auto-generated from [https://layerv.ai/guides/allow-tunnel-hostname-in-dev-server/](https://layerv.ai/guides/allow-tunnel-hostname-in-dev-server/) for AI agents. Curated agent resources: [llms.txt](https://layerv.ai/llms.txt). For the full interactive experience, visit the HTML version.*