Blocked request. This host ("app") is not allowed.

[MariuzM]

Describe the bug

I updated Vite to latest now I'm starting to have this, then i downgraded but still same thing, what is happening?

Blocked request. This host ("app") is not allowed.
To allow this host, add "app" to preview.allowedHosts in vite.config.js.

I use Railway as hosting and i have no idea how to fix this?

Reproduction

https://github.com/MariuzM/frameworks/tree/main/react-tsr

Steps to reproduce

No response

System Info

System:
    OS: macOS 14.7.2
    CPU: (10) arm64 Apple M1 Max
    Memory: 24.44 GB / 64.00 GB
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 20.17.0 - ~/dev/node-v20.17.0/bin/node
    Yarn: 1.22.22 - ~/dev/node-v20.17.0/bin/yarn
    npm: 10.8.2 - ~/dev/node-v20.17.0/bin/npm
    pnpm: 9.12.2 - ~/Library/pnpm/pnpm
    bun: 1.2.2 - ~/.bun/bin/bun
  Browsers:
    Brave Browser: 133.1.75.175
    Chrome: 130.0.6723.70
    Safari: 18.2

Used Package Manager

bun

Logs

No response

Validations

• Follow our Code of Conduct
• Read the Contributing Guidelines.
• Read the docs.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Make sure this is a Vite issue and not a framework-specific issue. For example, if it's a Vue SFC related bug, it should likely be reported to vuejs/core instead.
• Check that this is a concrete bug. For Q&A open a GitHub Discussion or join our Discord Chat Server.
• The provided reproduction is a minimal reproducible example of the bug.

[sapphi-red]

Since Vite 6.0.9+, 5.4.12+, 4.5.6+, you need to set preview.allowedHost if you are accessing the server with a host name other than localhost.
See GHSA-vg6x-rcgg-rjx6 for more details.

[YitzhakMizrahi]

This is Vite host-check protection. If Railway is reaching the Vite server with host app, Vite rejects it unless that hostname is explicitly allowed.

If you are running vite preview, add this:

// vite.config.ts
import { defineConfig } from "vite"

export default defineConfig({
  preview: {
    allowedHosts: ["app"],
  },
})

If you are running the dev server (vite dev / npm run dev) behind Railway, use server.allowedHosts instead:

export default defineConfig({
  server: {
    allowedHosts: ["app"],
  },
})

I would avoid allowedHosts: true unless this is only a temporary/private test environment, because it disables the host allowlist.

Also note that vite preview is intended for previewing a production build, not as the production server. For a real Railway deployment, the usual setup is to build the app and serve the static output with a production web server/platform integration.

Docs:

• preview.allowedHosts: https://vite.dev/config/preview-options.html#preview-allowedhosts
• static deploy / preview caveat: https://vite.dev/guide/static-deploy.html

[Abdeltoto]

TL;DR — Newer Vite is stricter about the Host header. Your app is being requested as host app (common on Railway / reverse proxies). Vite blocks it until you allow that hostname.

Fix (dev) — in vite.config.*:

export default defineConfig({
  server: {
    host: true,
    allowedHosts: ['app', '.railway.app'], // adjust to your real hostnames
  },
})

Fix (preview — matches your error text) — same idea under preview:

preview: {
  allowedHosts: ['app', '.railway.app'],
},

What to put in allowedHosts
Whatever appears in the browser / edge proxy: literal 'app' if that’s the host header, plus your public domain (often '.railway.app' to cover subdomains — leading dot = suffix match).

Production note — on Railway you usually serve the built assets with a static server or adapter, not vite preview. If you only use Vite in dev, fixing server.allowedHosts may be enough. If you deploy using vite preview, set preview as above.

After changing config, restart the dev server. If it still blocks, paste the exact Host: header from the failing request (from proxy logs) and we’ll match it precisely — typos here are the #1 follow-up issue.