From d7211ae807fca79ae62bf744476385d95c50f742 Mon Sep 17 00:00:00 2001 From: Joseph Date: Wed, 26 Aug 2026 12:29:42 +0200 Subject: [PATCH 1/9] docs: explain origin matching for allowedOrigins and allowedDevOrigins (#97805) The `allowedDevOrigins`, and `allowedOrigins` options, behave slightly different to each other, the former drops the PORT, and it is not clear where are these picked up from. This PR improves guidance on how to use these two. (cherry picked from commit efd592e9d01a40702b293df8595d087667102b5a) --- .../01-next-config-js/allowedDevOrigins.mdx | 22 ++++++++++++ .../01-next-config-js/serverActions.mdx | 34 ++++++++++++++++++- 2 files changed, 55 insertions(+), 1 deletion(-) diff --git a/docs/01-app/03-api-reference/05-config/01-next-config-js/allowedDevOrigins.mdx b/docs/01-app/03-api-reference/05-config/01-next-config-js/allowedDevOrigins.mdx index d869757d714a..c819b6e1f42d 100644 --- a/docs/01-app/03-api-reference/05-config/01-next-config-js/allowedDevOrigins.mdx +++ b/docs/01-app/03-api-reference/05-config/01-next-config-js/allowedDevOrigins.mdx @@ -16,3 +16,25 @@ module.exports = { allowedDevOrigins: ['local-origin.dev', '*.local-origin.dev'], } ``` + +Only the [`hostname`](https://developer.mozilla.org/en-US/docs/Web/API/URL/hostname) of the request's `Origin` header is matched against your entries. For a request from `http://local-origin.dev:3000/dashboard?tab=1`, that is `local-origin.dev`. The scheme, the port, the path, and the query string are ignored. Write your entries that way too, without `https://` and without a port. + +A no-cors cross-site request, such as a script tag loading a dev asset, sends no `Origin` header. Those are matched on the `Referer` hostname instead. + +Entries can also expand, through two wildcards: a `*` stands in for exactly one label of the hostname, and `**` for one or more. That is why the example above lists two entries, one for the bare hostname and one for its subdomains. + +| Entry | Matches | Does not match | +| --------------------- | --------------------------------------------------- | ---------------------------------------------- | +| `local-origin.dev` | `local-origin.dev` | `team.local-origin.dev` | +| `*.local-origin.dev` | `team.local-origin.dev` | `local-origin.dev`, `team.eu.local-origin.dev` | +| `**.local-origin.dev` | `team.local-origin.dev`, `team.eu.local-origin.dev` | `local-origin.dev` | + +Partial replacement is not supported. Write `*.local-origin.dev`, rather than `team-*.local-origin.dev`. Using `**` is only supported at the start of the pattern. + +The dev server already allows `localhost`, its subdomains, and the hostname it was started with. Any other hostname needs an entry, such as a tunnel used for remote development: + +```js filename="next.config.js" +module.exports = { + allowedDevOrigins: ['*.tunnel.example.com'], +} +``` diff --git a/docs/01-app/03-api-reference/05-config/01-next-config-js/serverActions.mdx b/docs/01-app/03-api-reference/05-config/01-next-config-js/serverActions.mdx index 31724d299b6c..3b2b7c8973d7 100644 --- a/docs/01-app/03-api-reference/05-config/01-next-config-js/serverActions.mdx +++ b/docs/01-app/03-api-reference/05-config/01-next-config-js/serverActions.mdx @@ -10,7 +10,7 @@ Options for configuring Server Actions behavior in your Next.js application. For ## `allowedOrigins` -A list of extra safe origin domains from which Server Actions can be invoked. Next.js compares the origin of a Server Action request with the host domain, ensuring they match to prevent CSRF attacks. If not provided, only the same origin is allowed. +A list of extra safe hosts from which Server Actions can be invoked. To prevent CSRF attacks, Next.js compares the host in a request's `Origin` header against the app's own host, taken from `x-forwarded-host` or `host`, and rejects the action when the two differ. If not provided, only the same origin is allowed. A request that carries no `Origin` header at all is allowed through with a warning rather than rejected. ```js filename="next.config.js" /** @type {import('next').NextConfig} */ @@ -24,6 +24,38 @@ module.exports = { } ``` +Only the [`host`](https://developer.mozilla.org/en-US/docs/Web/API/URL/host) of the request's `Origin` header is matched against your entries, which is the hostname plus the port when the URL carries one. For a request from `https://my-proxy.com/checkout`, that is `my-proxy.com`. For one from `https://my-proxy.com:8443/checkout`, `my-proxy.com:8443`. Write your entries the same way. + +Entries can also expand, through two wildcards: a `*` stands in for exactly one label of the host, and `**` for one or more. That is why the example above lists two entries, one for the bare host and one for its subdomains. + +| Entry | Matches | Does not match | +| ------------------- | ----------------------------------------- | --------------------------------------- | +| `my-proxy.com` | `my-proxy.com` | `my-proxy.com:8443`, `app.my-proxy.com` | +| `*.my-proxy.com` | `app.my-proxy.com` | `my-proxy.com`, `app.my-proxy.com:8443` | +| `**.my-proxy.com` | `app.my-proxy.com`, `app.eu.my-proxy.com` | `my-proxy.com` | +| `my-proxy.com:8443` | `my-proxy.com:8443` | `my-proxy.com` | + +Partial replacement is not supported. Write `*.my-proxy.com`, rather than `app-*.my-proxy.com`. Using `**` is only supported at the start of the pattern. A port cannot be wildcarded, so write it out in full: `my-proxy.com:8443`, or `*.my-proxy.com:8443` for its subdomains. + +Behind a reverse proxy, no entry is needed as long as the proxy forwards the public host in `x-forwarded-host`. When it forwards its own host instead, the browser sends `my-proxy.com` while the server reports something like `localhost:3000`, and that mismatch is what this list is for: the host visible in the browser's address bar is the one to add, not the internal one the server reports. + +The check runs in production as well as in development, so the list applies to your deployed app and not only to local work. + +For example, remote development through a tunnel needs the tunnel hostname in two places: in [`allowedDevOrigins`](/docs/app/api-reference/config/next-config-js/allowedDevOrigins), so the dev server serves its own assets and endpoints, and here, so actions from it are accepted: + +```js filename="next.config.js" +/** @type {import('next').NextConfig} */ + +module.exports = { + allowedDevOrigins: ['*.tunnel.example.com'], + experimental: { + serverActions: { + allowedOrigins: ['*.tunnel.example.com'], + }, + }, +} +``` + ## `bodySizeLimit` By default, the maximum size of the request body sent to a Server Action is 1MB, to prevent the consumption of excessive server resources in parsing large amounts of data, as well as potential DDoS attacks. From 3923d13042e0942cb071d008fea4baf74f32162a Mon Sep 17 00:00:00 2001 From: Rich Haines Date: Thu, 27 Aug 2026 19:47:39 +0200 Subject: [PATCH 2/9] docs: improve discovery summaries (#97982) This PR improves the meta descriptions on certain pages. (cherry picked from commit e80a85bcff19a4764182cb90bc34da4559fc5fef) --- docs/01-app/01-getting-started/15-route-handlers.mdx | 2 +- docs/01-app/01-getting-started/16-proxy.mdx | 2 +- .../04-api-reference/03-functions/use-report-web-vitals.mdx | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/01-app/01-getting-started/15-route-handlers.mdx b/docs/01-app/01-getting-started/15-route-handlers.mdx index 46c99925ef78..73765874ce0a 100644 --- a/docs/01-app/01-getting-started/15-route-handlers.mdx +++ b/docs/01-app/01-getting-started/15-route-handlers.mdx @@ -1,7 +1,7 @@ --- title: Route Handlers nav_title: Route Handlers -description: Learn how to use Route Handlers +description: Create custom request handlers with Next.js Route Handlers using the Web Request and Response APIs. related: title: API Reference description: Learn more about Route Handlers diff --git a/docs/01-app/01-getting-started/16-proxy.mdx b/docs/01-app/01-getting-started/16-proxy.mdx index 7a4d2a2bb26e..bb2cc167960c 100644 --- a/docs/01-app/01-getting-started/16-proxy.mdx +++ b/docs/01-app/01-getting-started/16-proxy.mdx @@ -1,7 +1,7 @@ --- title: Proxy nav_title: Proxy -description: Learn how to use Proxy +description: Use Next.js Proxy to rewrite, redirect, modify headers, or respond directly before a request completes. related: title: API Reference description: Learn more about Proxy diff --git a/docs/02-pages/04-api-reference/03-functions/use-report-web-vitals.mdx b/docs/02-pages/04-api-reference/03-functions/use-report-web-vitals.mdx index d0440861c6ca..1f66c66edac4 100644 --- a/docs/02-pages/04-api-reference/03-functions/use-report-web-vitals.mdx +++ b/docs/02-pages/04-api-reference/03-functions/use-report-web-vitals.mdx @@ -1,6 +1,6 @@ --- title: useReportWebVitals -description: useReportWebVitals +description: Use the Next.js `useReportWebVitals` hook to send Core Web Vitals and custom performance metrics to analytics. source: app/api-reference/functions/use-report-web-vitals --- From 545e120794ba2d4c9a30513b4cb856bf511b081e Mon Sep 17 00:00:00 2001 From: Aurora Scharff <66901228+aurorascharff@users.noreply.github.com> Date: Mon, 31 Aug 2026 11:22:47 +0200 Subject: [PATCH 3/9] docs: add layout stability guidance for videos and iframes (#98070) ## Summary - Document how dimensions and poster images keep video layouts stable while media loads. - Add equivalent sizing guidance for lazy-loaded iframes. ## Verification - `prettier --check docs/01-app/02-guides/videos.mdx` (cherry picked from commit 086294e2e5bee8352d69929ba5772e4d3863bba9) --- docs/01-app/02-guides/videos.mdx | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/docs/01-app/02-guides/videos.mdx b/docs/01-app/02-guides/videos.mdx index c745ec1127ca..90fb15c52250 100644 --- a/docs/01-app/02-guides/videos.mdx +++ b/docs/01-app/02-guides/videos.mdx @@ -17,7 +17,13 @@ The HTML [`