Fix Next.js “Blocked cross-origin request to Next.js dev resource”

Checked against the qURL™ CLI 3.4.1 source and documentation on October 9, 2026. Link and session behaviour is tested separately.

Content updated October 18, 2026. The verification date above records the original review; later behaviour checks are dated in the guide.

Why does next dev block requests when I open my app through a tunnel?

Since Next.js 16.2, next dev blocks requests to its dev-only resources from origins it does not know, so hot reload fails when you open the app through a tunnel. Add the tunnel’s hostname pattern to allowedDevOrigins in next.config.js, such as *.qurl.site or *.ngrok-free.app, and restart next dev. Production builds are not affected.

What you need

• A Next.js app running with next dev, opened through a tunnel or another hostname
• Your next.config.js (or next.config.ts)

Steps

1. Read the origin from the log

   next dev logs “Blocked cross-origin request to Next.js dev resource … from “host”” and answers 403. The exact wording varies by release. Next.js 16.1 and earlier only warned: “Cross origin request detected from … to /_next/* resource.”

2. Add the tunnel’s hostname to allowedDevOrigins

   Next.js matches only the hostname of the request’s Origin, so write entries without https:// and without a port. A * stands for exactly one label and ** for one or more, only at the start of a pattern. If you use Server Actions, add the same pattern to serverActions.allowedOrigins.

   // next.config.js
   module.exports = {
     allowedDevOrigins: ['*.qurl.site'], // or '*.ngrok-free.app', '*.trycloudflare.com'
     experimental: {
       serverActions: { allowedOrigins: ['*.qurl.site'] },
     },
   }

3. Restart next dev

   Next.js reads allowedDevOrigins at start-up. next dev listens on every interface by default, so start it with -H 127.0.0.1 to keep it off your network while a tunnel or qURL reaches it on localhost.

   next dev -H 127.0.0.1

What the recipient sees

With the origin allowed, the page and its dev resources load through the link, and the hot reload socket can connect.

Which tool fits sharing a next dev server?

Troubleshooting

Frequently Asked Questions