title: What is the purpose of webpack-dev-server's allowedHosts security mechanism?
body: <p>What security risk is <code>webpack-dev-server</code> trying to mitigate by enforcing specific <code>Host</code> header values?</p>
  
  <p>By default, <code>webpack-dev-server</code> only allows connections whose <code>Host</code> header specifies a local loopback address (<code>localhost</code>, <code>127.0.0.1</code>, etc). All other hosts get this response: "Invalid Host header". But of course the <code>--allowed-hosts</code>/<code>allowedHosts</code> configuration allows this restriction to be broadened.</p>
  
  <p>This appears to be based solely on the <code>Host</code> header. I can set a custom Host header with curl, and the request succeeds:</p>
  
  <pre class="lang-sh prettyprint-override"><code>curl -X GET -H "Host: http://0.0.0.0:9001/" http://me.internal.example.com:9001/
  </code></pre>
  
  <p>So I'm curious — if <code>allowedHosts</code> doesn't prevent connections from curl or other custom user agents, what problem does it solve? It seems aimed only at normal users using normal browsers, to protect them from a site served at the wrong host. But a Man-In-The-Middle attack could just as easily proxy the connection and override the Host header. </p>
  
  <p>To prevent MITM attacks, you'd use https (with a certificate that's trusted by the browser). But in that case, the certificate would seem to mitigate the MITM attack by itself.</p>
  
  <p>I'm sure I'm missing something, so any further explanation is appreciated.</p>