From c9a4ac43d2bc3fee50b88933e0a4cf590992e2fa Mon Sep 17 00:00:00 2001
From: ridemountainpig <lin0905580802@gmail.com>
Date: Sat, 18 Jul 2026 10:44:47 +0800
Subject: [PATCH] feat(core): add allowedHosts to open-slide.config.ts

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .changeset/allowed-hosts-config.md         |  5 +++++
 apps/web/content/docs/cli/dev.mdx          |  5 +++++
 apps/web/content/docs/reference/config.mdx | 24 ++++++++++++++++++++++
 packages/core/src/config.ts                |  1 +
 packages/core/src/vite/config.ts           |  1 +
 5 files changed, 36 insertions(+)
 create mode 100644 .changeset/allowed-hosts-config.md

diff --git a/.changeset/allowed-hosts-config.md b/.changeset/allowed-hosts-config.md
new file mode 100644
index 000000000..0c115b264
--- /dev/null
+++ b/.changeset/allowed-hosts-config.md
@@ -0,0 +1,5 @@
+---
+"@open-slide/core": minor
+---
+
+Add `allowedHosts` to `open-slide.config.ts` so proxied domains (Coder, Codespaces, reverse proxies) can reach the dev and preview servers.
diff --git a/apps/web/content/docs/cli/dev.mdx b/apps/web/content/docs/cli/dev.mdx
index bda5ac2f6..1cde53b07 100644
--- a/apps/web/content/docs/cli/dev.mdx
+++ b/apps/web/content/docs/cli/dev.mdx
@@ -49,3 +49,8 @@ const config: OpenSlideConfig = {
 
 export default config;
 ```
+
+Accessing the dev server through a proxied domain (Coder, Codespaces, a
+reverse proxy) and hitting `Blocked request. This host is not allowed.`?
+Set [`allowedHosts`](/docs/reference/config#remote-ide--proxied-dev-server)
+in the config.
diff --git a/apps/web/content/docs/reference/config.mdx b/apps/web/content/docs/reference/config.mdx
index be808432b..40777f597 100644
--- a/apps/web/content/docs/reference/config.mdx
+++ b/apps/web/content/docs/reference/config.mdx
@@ -43,6 +43,11 @@ export default config;
       default: 'first free port from 5173 upward',
       description: 'Dev server port.',
     },
+    allowedHosts: {
+      type: 'string[] | true',
+      default: "Vite's default host check",
+      description: 'Hostnames the dev/preview server responds to. `true` allows any host.',
+    },
     build: {
       type: 'OpenSlideBuildConfig',
       default: 'all toggles on',
@@ -104,6 +109,25 @@ const config: OpenSlideConfig = {
 The value is passed straight to Vite's `base` and to React Router's
 `basename`, so client-side navigation matches the deployed path.
 
+### Remote IDE / proxied dev server
+
+Cloud workspaces (Coder, Codespaces, Gitpod, …) reach the dev server through
+a generated domain, so Vite blocks the request with
+`Blocked request. This host (…) is not allowed.` Allow your workspace domain
+— a leading dot matches every subdomain:
+
+```ts
+const config: OpenSlideConfig = {
+  allowedHosts: ['.my-workspace.example.com'],
+};
+```
+
+Or set `allowedHosts: true` to accept any host. Only do this on a trusted
+network — it disables Vite's DNS-rebinding protection. The value is passed
+straight to Vite's
+[`server.allowedHosts`](https://vite.dev/config/server-options#server-allowedhosts)
+and also applies to `open-slide preview`.
+
 ### Organizing many decks
 
 `slidesDir` is a single path and decks must sit directly inside it
diff --git a/packages/core/src/config.ts b/packages/core/src/config.ts
index f98868278..af8318248 100644
--- a/packages/core/src/config.ts
+++ b/packages/core/src/config.ts
@@ -12,6 +12,7 @@ export type OpenSlideConfig = {
   themesDir?: string;
   assetsDir?: string;
   port?: number;
+  allowedHosts?: string[] | true;
   /**
    * @deprecated Pick the UI language from the language switcher in the slide UI
    * instead. When set, this only seeds the initial language until the user
diff --git a/packages/core/src/vite/config.ts b/packages/core/src/vite/config.ts
index ac0286a83..cfcdbfc67 100644
--- a/packages/core/src/vite/config.ts
+++ b/packages/core/src/vite/config.ts
@@ -113,6 +113,7 @@ export async function createViteConfig(opts: CreateViteConfigOptions): Promise<I
     },
     server: {
       port: config.port ?? 5173,
+      ...(config.allowedHosts !== undefined ? { allowedHosts: config.allowedHosts } : {}),
       fs: { allow: [APP_ROOT, userCwd, slidesAbs, themesAbs, assetsAbs] },
     },
     build: {