From df1d388465b6f0d3aab5fb4f011cbbe74d3058f4 Mon Sep 17 00:00:00 2001
From: Alan Agius <alanagius@google.com>
Date: Wed, 12 Feb 2025 09:42:28 +0000
Subject: [PATCH] fix(@angular/build): configure Vite CORS option
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Vite's `allowedHosts` option does not enable CORS; instead, it allows the dev server to respond to requests with a matching hostname (e.g., http://example.com/main.js). It only verifies that the request’s hostname is on the allowed list. However, this does not consider the `origin` in the case of a CORS request.

This commit updates Vite's configuration to enable CORS.

Closes #29549

(cherry picked from commit be15b886c75d0ed9834aef38690d3169fcf16ef5)
---
 packages/angular/build/src/builders/dev-server/schema.json    | 4 ++--
 packages/angular/build/src/builders/dev-server/vite-server.ts | 3 +++
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/packages/angular/build/src/builders/dev-server/schema.json b/packages/angular/build/src/builders/dev-server/schema.json
index 3d5cf155aae2..c36d8614e4ea 100644
--- a/packages/angular/build/src/builders/dev-server/schema.json
+++ b/packages/angular/build/src/builders/dev-server/schema.json
@@ -37,12 +37,12 @@
       "description": "SSL certificate to use for serving HTTPS."
     },
     "allowedHosts": {
-      "description": "The hosts that can access the development server. This option sets the Vite option of the same name. For further details: https://vite.dev/config/server-options.html#server-allowedhosts",
+      "description": "The hosts that the development server will respond to. This option sets the Vite option of the same name. For further details: https://vite.dev/config/server-options.html#server-allowedhosts",
       "default": [],
       "oneOf": [
         {
           "type": "array",
-          "description": "List of hosts that are allowed to access the development server.",
+          "description": "A list of hosts that the development server will respond to.",
           "items": {
             "type": "string"
           }
diff --git a/packages/angular/build/src/builders/dev-server/vite-server.ts b/packages/angular/build/src/builders/dev-server/vite-server.ts
index fcdf5e42934a..6773e8945c21 100644
--- a/packages/angular/build/src/builders/dev-server/vite-server.ts
+++ b/packages/angular/build/src/builders/dev-server/vite-server.ts
@@ -841,6 +841,9 @@ export async function setupServer(
           ? (proxy ?? {})
           : proxy,
       cors: {
+        // This will add the header `Access-Control-Allow-Origin: http://example.com`,
+        // where `http://example.com` is the requesting origin.
+        origin: true,
         // Allow preflight requests to be proxied.
         preflightContinue: true,
       },