Which Host header behavior is expected when server.proxy.changeOrigin is disabled?

Answer

When server.proxy.changeOrigin is omitted or set to false, Vite’s proxy (powered by http-proxy) forwards the Host header exactly as it was sent by the browser. The proxy does not rewrite it to match the target URL. Consequently, the backend receives the original host value and, if it uses the Host header for virtual‑hosting or SSL validation, the request may be routed incorrectly or rejected.

Why This Happens

The default http-proxy configuration preserves incoming headers unless changeOrigin is explicitly enabled. Vite simply forwards the proxy options to the underlying library, so the behavior is governed by http-proxy's default settings.

How to Verify the Header Propagation

1. Create a minimal target server that logs the received Host header. For example, a Node/Express app:

   const express = require('express');
   const app = express();
   app.use((req, res, next) => {
     console.log('Received Host:', req.headers.host);
     next();
   });
   app.get('*', (req, res) => res.send('ok'));
   app.listen(4000, () => console.log('Target listening on 4000'));
   

2. Configure Vite to proxy to that target without changing the origin:

   export default {
     server: {
       proxy: {
         '/api': {
           target: 'http://localhost:4000',
           // changeOrigin is omitted or set to false
         }
       }
     }
   };
   

3. Send a request through Vite’s dev server:

   curl -v http://localhost:5173/api/hello
   

   The verbose output shows the Host header that Vite forwards. It should match the value the browser originally sent (e.g., localhost:5173 or whatever the client used).
4. Alternatively, use a debugging proxy such as mitmproxy or Wireshark to capture the outbound request and inspect the Host header.

Potential Pitfalls

• If the target server expects Host: api.example.com for routing or SSL, the request may fail or hit the wrong virtual host.
• Some security tools flag traffic where the Host header does not match the target domain.

Next Steps (If You Encounter Issues)

Check whether the backend requires a specific Host value. If so, either enable changeOrigin: true or add a custom header rewrite rule in Vite’s proxy configuration.