Previously, we were checking host/origin header in the explorer worker to ensure we only allow same-origin localhost reqs. However, if you have a route set (custom domain etc.), Miniflare does its best to make it look like your local dev is coming from that host, and rewrites headers etc. accordingly. This means we were incorrectly blocking requests as cross-origin when you had a route set - when the local explorer UI makes a request to the local explorer API and the origin and host headers are both my-site.com etc., but our allowed host lists was only localhost.

Also, Wrangler's Proxy miniflare instance (the startDevWorker proxy worker) rewrites headers too, to complicate things.

Basically this PR gets the user routes, adds it to our allowed hosts lists and then everything seems to work.

I've moved the check to the entry worker since we have access to the routes there. I'm only doing this check on explorer routes, because i'm worried this could block some legit usecase i haven't thought of, but if we don't see issues after the local explorer gets use, we could consider moving this to cover all cdn-cgi routes.

• Tests
  • Tests included/updated
  • Automated tests not possible - manual testing has been completed as follows:
  • Additional testing not necessary because:
• Public documentation
  • Cloudflare docs PR(s):
  • Documentation not necessary because: wip experimental feature

A picture of a cute animal (not mandatory, but encouraged)