From dbccce445bb2c59518a905af6b62fad8065f6033 Mon Sep 17 00:00:00 2001
From: gorkem-bwl <gorkem.cetin@bluewavelabs.ca>
Date: Thu, 23 Apr 2026 23:31:05 -0400
Subject: [PATCH] fix(client): allow configurable Vite allowed hosts

Vite >=4.3 rejects requests with a Host header not in the allowlist,
which broke status-page submissions and dev-server access for users
serving Checkmate behind a reverse proxy after upgrading.

Adds VITE_ALLOWED_HOSTS env var (comma-separated list). When unset,
falls back to allowing all hosts so existing self-hosted deployments
keep working without changes.

Closes #3397
Closes #2951
---
 client/vite.config.ts | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/client/vite.config.ts b/client/vite.config.ts
index 075bc7a0b..f9305407a 100644
--- a/client/vite.config.ts
+++ b/client/vite.config.ts
@@ -9,11 +9,20 @@ const __dirname = path.dirname(__filename);
 export default defineConfig(({}) => {
 	let version = "3.6.1";
 
+	const allowedHosts = process.env.VITE_ALLOWED_HOSTS
+		? process.env.VITE_ALLOWED_HOSTS.split(",").map((h) => h.trim())
+		: true;
+
 	return {
 		base: "/",
 		plugins: [svgr(), react()],
 		server: {
 			host: true,
+			allowedHosts,
+		},
+		preview: {
+			host: true,
+			allowedHosts,
 		},
 		resolve: {
 			alias: {