[HugoRCD]

Written by an AI agent on behalf of @HugoRCD. @HugoRCD has not reviewed it yet.

Without a token, the local stream server (startStreamServer, stream: true in Nuxt and Next.js) is meant to serve only this machine. It had two gaps:

• It matched the Origin host with startsWith('localhost'), so a page on https://localhost.example.com or https://127.0.0.1.example.com passed.
• It never checked Host. A page whose domain is rebound to 127.0.0.1 sends no Origin on a same-origin GET, so it passed too.

Either way the page reads every wide event as it is emitted, plus the replay buffer. Redaction is off by default in dev, so those events carry real request data. The Nuxt discovery route /api/_evlog/stream-info answered with Access-Control-Allow-Origin: *, so any site could also learn the ephemeral port.

Fix

• Without a token, a request is accepted only when its Host hostname is exactly localhost, 127.0.0.1 or [::1], and its Origin, if sent, is one of those exactly. The check lives in src/shared/loopback.ts (internal, not exported).
• /api/_evlog/stream-info echoes Access-Control-Allow-Origin only for loopback origins, with Vary: Origin. A dev tool on another local port still works; the docs only describe same-origin use.
• Token mode is unchanged: a valid bearer token is accepted from any Host, as the docs require for host: '0.0.0.0'.

Before and after

Requests to a running stream server with no token:

Request	main	This PR
Origin: http://localhost:3000	200	200
Origin: https://evil.com	403	403
Origin: https://localhost.evil.com	200	403
Origin: https://127.0.0.1.evil.com	200	403
No Origin, Host: rebind.evil.com	200	403

The new tests on main:

× rejects origins that only start with a loopback name
AssertionError: https://localhost.evil.com: expected 200 to be 403
× rejects a non-loopback Host without a token, as a DNS-rebound page sends
AssertionError: expected 200 to be 403
× lets a loopback origin on another port read the stream URL
AssertionError: expected '*' to be 'http://localhost:3001'
× does not let other sites read the stream URL
AssertionError: https://evil.com: expected '*' to be null

All pass on this branch. The docs table in 6.extend/1.stream.md describes the new rule.

Checks

• pnpm run lint: pass
• pnpm run typecheck --filter='!evlog-telemetry' (the CI filter): pass
• pnpm test:coverage: 112 files, 2,223 tests pass. Coverage 92.32 / 86.08 / 95.56 / 94.32 (statements / branches / functions / lines)
• pnpm content:lint on the changeset and the stream docs page: 100

ELI5

The live log viewer runs a small server on your computer and is only supposed to talk to your computer. It checked "does the address start with localhost?", so a website named localhost.something.com could listen to your app's logs. It now checks that the address is exactly your computer.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
evi	Ready	Preview	Oct 17, 2026 12:36pm UTC
evlog-docs	Building	Preview, v0	Oct 17, 2026 12:36pm UTC
evlog-render-lab	Ready	Preview	Oct 17, 2026 12:36pm UTC
evlog-telemetry	Ready	Preview	Oct 17, 2026 12:36pm UTC
just-use-evlog	Ready	Preview	Oct 17, 2026 12:36pm UTC

[github-actions]

Thank you for following the naming conventions! 🙏

[pkg-pr-new]

@evlog/cli

npm i https://pkg.pr.new/@evlog/cli@889

evlog

npm i https://pkg.pr.new/evlog@889

@evlog/nuxthub

npm i https://pkg.pr.new/@evlog/nuxthub@889

@evlog/signals

npm i https://pkg.pr.new/@evlog/signals@889

@evlog/telemetry

npm i https://pkg.pr.new/@evlog/telemetry@889

commit: 7453f8b

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 18662391-da27-455d-835f-7ec661ee5ef5

📥 Commits

Reviewing files that changed from the base of the PR and between 6e59678 and 7453f8b.

📒 Files selected for processing: 7

• .changeset/stream-loopback-origin.md
• apps/docs/content/6.extend/1.stream.md
• packages/evlog/src/runtime/server/routes/_evlog/stream-info.get.ts
• packages/evlog/src/shared/loopback.ts
• packages/evlog/src/stream.ts
• packages/evlog/test/http/stream-server.test.ts
• packages/evlog/test/nuxt/stream-info.test.ts

+---------------------------------------+
| CI/CD: Code Inspection/Catch Defects. |
+---------------------------------------+
  \
   \     /)/)
        ( '')
        /  |
      o(___)

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}