“Blocked request. This host is not allowed”: The Host-Header Allowlist Cheat Sheet for Vite, Rails, Django, Angular and Next.js
You start a tunnel, paste the public URL into a browser, and instead of your app you get a flat error. In a Vite project it reads Blocked request. This host ("your-name.tunnel.example.com") is not allowed. In Rails you get a 403 Forbidden response. In Django it is a 400 Bad Request. In Angular’s dev server it is the Vite message again. In Next.js your page may load, but dev-only requests under /_next/* get blocked. None of this is a tunnel bug. Your dev server received a request for a hostname it has never heard of, and it refused to answer. This guide is a per-framework cheat sheet: the exact setting, what it accepts, what the default is, and how to configure it safely. It also explains why a stable tunnel subdomain turns this from a recurring annoyance into a one-time config line. Why dev servers check the Host header at all Every HTTP request carries a Host header naming the site the browser thinks it is talking to. Historically, many dev servers ignored it. That b...
