Platform host lists
security.allowedHosts is the list of host names the app answers for.
security.allowedHosts is the list of host names the app answers for. The handler checks it for every request. On the Node,
Bun and Deno layers the static file layer checks it too, before it reads a file. On the platforms that answer a file before
the function runs, the adapter writes the list into the platform's routing, when the build can read the list as a literal
(in dusk.config.ts, or in src/entry-server.ts as a literal list). A list the build cannot read (a call, an import, a
computed value) writes no platform host route: the handler still checks the Host at run time, but the platform's own file
answers are then not host-checked. Use a literal list when you deploy to one of these platforms.
| Where the request lands first | A refused Host gets | Limits |
|---|---|---|
Node (dusk start, the generated server.mjs, serve()), Bun, Deno |
the handler's 400, for any path, file or not | none |
Vercel (config.json) |
a first route with a missing host condition, whose value is the list as a regular expression, sends the request to the function before handle: "filesystem"; the function answers the handler's 400 |
the condition is the has/missing host form of Vercel's routing (value { re }), checked against the emitted config.json, not a live deployment |
Cloudflare Workers (wrangler.toml) |
run_worker_first = true: the Worker runs for every request. A listed Host gets its file from the ASSETS binding (a 404 from it falls through to the handler). A refused Host, a method other than GET or HEAD, and a prerendered page a rule applies to go to the handler |
each asset request is a Worker invocation while the list is set, which costs requests; the unit tests use a fake assets binding; the local smoke runs the Worker with the real assets binding under wrangler dev --local (wrangler 4.149.0) |
Netlify (_redirects, netlify.toml, the function and edge declarations) |
nothing is routed: Netlify documents no Host condition in those files, so the adapter writes a comment saying so | the function refuses a foreign Host for every request it answers (400). A file the CDN serves without a function is not host-checked: which files the platform answers first is set by its precedence rules, not by Dusk |
With no host list, the Vercel routes, the Cloudflare configuration and the Netlify output are the same as before, and the Worker is the plain handler (no assets lookup, no extra invocation).
public/ files are answered before the global middleware on every layer, as before, unless runMiddlewareForStaticFiles is
set: then the Node server, the Bun and Deno servers and the Cloudflare Worker run the middleware for them first, and Vercel,
Netlify and the static export warn at build time (see the security guide).